3GPP2 C.S0016-D v2.

0 April 2012

Over-the-Air Service Provisioning of Mobile Stations in Spread Spectrum Standards

2012 3GPP2 3GPP2 and its Organizational Partners claim copyright in this document and individual Organizational Partners may copyright and issue documents or standards publications in individual Organizational Partners name based on this document. Requests for reproduction of this document should be directed to the 3GPP2 Secretariat at secretariat@3gpp2.org. Requests to reproduce individual Organizational Partners documents should be directed to that Organizational Partner. See www.3gpp2.org for more information.

3GPP2 C.S0016-D v2.0

Revision History
Revision C.S0016-0 C.S0016-A v2.0 C.S0016-B v1.0 C.S0016-C v1.0 C.S0016-D v1.0 Description of Changes Release 0 Release A Release B Release C Release D Date May 1998 December 2001 October 2002 October 2004 January 2010

C.S0016-D v2.0

Point Release

April 2012

3GPP2 C.S0016-D v2.0

CONTENTS 1 INTRODUCTION ........................................................................................................ 1-1 1.1 Scope ..................................................................................................................... 1-1 1.2 Terms and Numeric Information ............................................................................. 1-1 1.2.1 Terms ............................................................................................................... 1-1 1.2.2 Numeric Information ........................................................................................ 1-6 1.2.3 Constants ......................................................................................................... 1-9 1.3 References ............................................................................................................ 1-10 1.3.2 Normative References ..................................................................................... 1-10 1.3.2 Informative References ................................................................................... 1-12 1.4 Requirements Language ....................................................................................... 1-13 2 MESSAGE TRANSPORT PROTOCOL ........................................................................ 2-15 2.1 General ................................................................................................................ 2-15 2.2 Analog Transport Protocol .................................................................................... 2-15 2.2.1 OTASP Data Message Encapsulation ............................................................... 2-15 2.2.2 OTASP Data Message Segmentation ................................................................ 2-16 2.2.3 Mobile Station Procedures .............................................................................. 2-18 2.2.3.1 OTASP Transport Message Acknowledgment and Re-transmission ............ 2-18 2.2.3.2 Message Transmission .............................................................................. 2-19 2.2.3.3 Message Reception .................................................................................... 2-19 2.2.3.4 Reverse Voice Channel Message Format.................................................... 2-22 2.2.3.4.1 OTASP Transport Message ................................................................... 2-22 2.2.3.4.2 OTASP Transport Confirmation Message ............................................... 2-24 2.2.4 Base Station Procedures ................................................................................. 2-25 2.2.4.1 Message Transmission .............................................................................. 2-25 2.2.4.2 Message Reception .................................................................................... 2-26 2.2.4.3 Forward Voice Channel Message Format ................................................... 2-27 2.2.4.3.1 OTASP Transport Message ................................................................... 2-27 2.2.4.3.2 OTASP Transport Confirmation Message ............................................... 2-30 2.3 CDMA Transport Protocol ..................................................................................... 2-31 3 MOBILE STATION PROCEDURES.............................................................................. 3-1

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

3GPP2 C.S0016-D v2.0

CONTENTS
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

3.1 Initial Values and NAM Parameters ........................................................................ 3-1 3.2 Initiation of the Programming Procedures ............................................................... 3-2 3.2.1 User-Initiated Procedure ................................................................................. 3-2 3.2.2 Network-Initiated Procedure ........................................................................... 3-5 3.2.2.1 Initiation of OTAPA in the CDMA Mobile Station Idle State .......................... 3-5 3.2.2.2 Connection of the OTAPA Service Option .................................................... 3-5 3.2.2.3 Starting the OTAPA session ........................................................................ 3-7 3.3 Programming Procedure ........................................................................................ 3-7 3.3.1 OTASP Data Message Processing ....................................................................... 3-7 3.3.1.1 Configuration Request Message Processing ................................................. 3-8 3.3.1.2 Download Request Message Processing ....................................................... 3-8 3.3.1.3 Commit Request Message Processing .......................................................... 3-9 3.3.1.4 Re-Authenticate Request Message Processing ........................................... 3-11 3.3.1.5 MS Key Request Message Processing ........................................................ 3-11 3.3.1.6 Key Generation Request Message Processing ............................................ 3-13 3.3.1.7 Protocol Capability Request Message Processing ....................................... 3-14 3.3.1.8 SSPR Configuration Request Message Processing ..................................... 3-14 3.3.1.9 SSPR Download Request Message Processing ........................................... 3-15 3.3.1.10 Validation Request Message Processing .................................................. 3-17 3.3.1.11 OTAPA Request Message Processing ....................................................... 3-19 3.3.1.12 PUZL Configuration Request Message Processing.................................... 3-20 3.3.1.13 PUZL Download Request Message Processing ......................................... 3-23 3.3.1.14 3GPD Configuration Request Message Processing ................................... 3-26 3.3.1.15 3GPD Download Request Message Processing ......................................... 3-27 3.3.1.16 Secure Mode Request Message Processing .............................................. 3-30 3.3.1.17 MMD Configuration Request Message Processing.................................... 3-30 3.3.1.18 MMD Download Request Message Processing ......................................... 3-31 3.3.1.19 System Tag Configuration Request Message Processing .......................... 3-32 3.3.1.20 System Tag Download Request Message Processing ................................ 3-33 3.3.1.21 Service Key Generation Request Message Processing .............................. 3-35

ii

3GPP2 C.S0016-D v2.0

CONTENTS
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

3.3.1.22 MMS Configuration Request Message Processing .................................... 3-35 3.3.1.23 MMS Download Request Message Processing .......................................... 3-36 3.3.1.24 MMSS Configuration Request Message Processing .................................. 3-37 3.3.1.25 MMSS Download Request Message Processing ........................................ 3-38 3.3.2 Mobile Station SSD Update and Re-authentication ......................................... 3-40 3.3.3 Activation of Message Encryption ................................................................... 3-41 3.3.4 Activation of Voice Privacy .............................................................................. 3-42 3.3.5 System Selection for Preferred Roaming .......................................................... 3-42 3.3.6 Service Programming Lock .............................................................................. 3-42 3.3.7 Subscriber Parameter Administration Security Mechanism ............................ 3-43 3.3.8 Secure Mode ................................................................................................... 3-44 3.3.8.1 Generation of Secure Mode Ciphering Key ................................................ 3-44 3.3.8.2 Encryption and Decryption of messages in Secure Mode ........................... 3-45 3.3.9 System Tag Indicator ...................................................................................... 3-45 3.3.10 Generation of Service Keys............................................................................ 3-46 3.3.10.1 Generation of Intermediate Key ............................................................... 3-46 3.3.10.2 Generation of Service Keys ...................................................................... 3-46 3.4 Termination of the Programming Procedure .......................................................... 3-47 3.5 Reverse Link Message Formats ............................................................................. 3-48 3.5.1 Message Contents ........................................................................................... 3-50 3.5.1.1 Configuration Response Message .............................................................. 3-50 3.5.1.2 Download Response Message .................................................................... 3-51 3.5.1.3 MS Key Response Message........................................................................ 3-55 3.5.1.4 Key Generation Response Message ........................................................... 3-55 3.5.1.5 Re-Authenticate Response Message .......................................................... 3-56 3.5.1.6 Commit Response Message ....................................................................... 3-57 3.5.1.7 Protocol Capability Response Message ...................................................... 3-57 3.5.1.8 SSPR Configuration Response Message ..................................................... 3-62 3.5.1.9 SSPR Download Response Message .......................................................... 3-63 3.5.1.10 Validation Response Message ................................................................. 3-64

iii

3GPP2 C.S0016-D v2.0

CONTENTS
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

3.5.1.11 OTAPA Response Message ...................................................................... 3-65 3.5.1.12 PUZL Configuration Response Message ................................................... 3-66 3.5.1.13 PUZL Download Response Message......................................................... 3-67 3.5.1.14 3GPD Configuration Response Message .................................................. 3-69 3.5.1.15 3GPD Download Response Message ........................................................ 3-70 3.5.1.16 Secure Mode Response Message ............................................................. 3-71 3.5.1.17 Extended Protocol Capability Response Message ..................................... 3-72 3.5.1.17.1 Capability Information Record ........................................................... 3-74 3.5.1.17.1.1 Operating Mode Information ........................................................ 3-74 3.5.1.17.1.2 CDMA Band Class Information .................................................... 3-75 3.5.1.17.1.3 MEID........................................................................................... 3-76 3.5.1.17.1.4 ICCID .......................................................................................... 3-76 3.5.1.17.1.5 EXT_UIM_ID ................................................................................ 3-77 3.5.1.17.1.6 MEID_ME .................................................................................... 3-77 3.5.1.18 MMD Configuration Response Message ................................................... 3-78 3.5.1.19 MMD Download Response Message......................................................... 3-79 3.5.1.20 System Tag Configuration Response Message ......................................... 3-80 3.5.1.21 System Tag Download Response Message ............................................... 3-81 3.5.1.22 Service Key Generation Response Message ............................................. 3-82 3.5.1.23 MMS Configuration Response Message ................................................... 3-82 3.5.1.24 MMS Download Response Message ......................................................... 3-84 3.5.1.25 MMSS Configuration Response Message ................................................. 3-85 3.5.1.26 MMSS Download Response Message ....................................................... 3-88 3.5.2 NAM Parameter Blocks ................................................................................... 3-90 3.5.2.1 CDMA/Analog NAM Parameter Block ........................................................ 3-91 3.5.2.2 Mobile Directory Number .......................................................................... 3-94 3.5.2.3 CDMA NAM Parameter Block .................................................................... 3-95 3.5.2.4 IMSI_T Parameter Block ............................................................................ 3-97 3.5.2.5 eHRPD IMSI Parameter Block ................................................................... 3-98 3.5.3 SSPR Parameter Blocks .................................................................................. 3-99

iv

3GPP2 C.S0016-D v2.0

CONTENTS
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

3.5.3.1 Preferred Roaming List Dimensions Parameter Block .............................. 3-100 3.5.3.2 Preferred Roaming List Parameter Block ................................................. 3-101 3.5.3.3 Extended Preferred Roaming List Dimensions Parameter Block .............. 3-103 3.5.4 Reserved ....................................................................................................... 3-104 3.5.5 Preferred Roaming List and Extended Preferred Roaming List ....................... 3-104 3.5.5.1 Preferred Roaming List CRC Calculation ................................................. 3-109 3.5.5.2 Acquisition Records ................................................................................ 3-109 3.5.5.2.1 Acquisition Record Formats .............................................................. 3-111 3.5.5.2.1.1 Cellular Analog System Acquisition Record ................................. 3-111 3.5.5.2.1.2 Cellular CDMA and JTACS CDMA System Acquisition (Standard Channels) Record .......................................................................................... 3-112 3.5.5.2.1.3 Cellular CDMA and JTACS CDMA System Acquisition (Custom Channels) Record .......................................................................................... 3-113 3.5.5.2.1.4 Cellular CDMA Preferred System Acquisition Record ................... 3-114 3.5.5.2.1.5 PCS CDMA System Acquisition (Using Blocks) Record ................. 3-114 3.5.5.2.1.6 PCS CDMA and 2 GHz Band CDMA System Acquisition (Using Channels) Record .......................................................................................... 3-115 3.5.5.2.1.7 JTACS CDMA System Acquisition (Standard Channels) Record ... 3-116 3.5.5.2.1.8 JTACS CDMA System Acquisition (Custom Channels) Record ..... 3-116 3.5.5.2.1.9 2 GHz Band CDMA System Acquisition (Using Channels) Record 3-117 3.5.5.2.2 Extended Acquisition Record Format ................................................ 3-118 3.5.5.2.2.1 Cellular Analog System Acquisition Record ................................. 3-118 3.5.5.2.2.2 Cellular CDMA System Acquisition (Standard Channels) Record . 3-119 3.5.5.2.2.3 Cellular CDMA System Acquisition (Custom Channels) Record ... 3-119 3.5.5.2.2.4 Cellular CDMA Preferred System Acquisition Record ................... 3-120 3.5.5.2.2.5 PCS CDMA System Acquisition (Using Blocks) Record ................. 3-120 3.5.5.2.2.6 PCS CDMA System Acquisition (Using Channels) Record ............ 3-121 3.5.5.2.2.7 JTACS CDMA System Acquisition (Standard Channels) Record ... 3-122 3.5.5.2.2.8 JTACS CDMA System Acquisition (Custom Channels) Record ..... 3-122 3.5.5.2.2.9 2 GHz Band CDMA System Acquisition (Using Channels) Record 3-123 3.5.5.2.2.10 Generic Acquisition Record for cdma2000 1x and IS-95 ............ 3-123

3GPP2 C.S0016-D v2.0

CONTENTS
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

3.5.5.2.2.11 Generic Acquisition Record for HRPD ........................................ 3-124 3.5.5.2.2.12 Reserved for Obsolete Identification Record Types ..................... 3-124 3.5.5.2.2.13 Common Acquisition Table Record for UMB .............................. 3-124 3.5.5.2.2.14 Generic Acquisition Record for UMB .......................................... 3-126 3.5.5.3 System Record and Extended System Record Format ............................. 3-127 3.5.5.3.1 System Record Format ...................................................................... 3-127 3.5.5.3.2 Extended System Record Format ...................................................... 3-129 3.5.5.3.2.1 Common Subnet Table for the HRPD Extended System Record ... 3-135 3.5.5.3.2.2 Type-specific System ID Record of type 0011 ............................. 3-135 3.5.6 PUZL Parameter Blocks ................................................................................ 3-139 3.5.6.1 PUZL Dimensions Parameter Block ......................................................... 3-141 3.5.6.2 PUZL Priorities Parameter Block ............................................................. 3-145 3.5.6.3 User Zone Parameter Block ..................................................................... 3-146 3.5.6.4 Preferred User Zone List Parameter Block ............................................... 3-147 3.5.7 Preferred User Zone List (PUZL) .................................................................... 3-148 3.5.7.1 User Zone Type Specific Fields ................................................................ 3-156 3.5.7.1.1 User Zone Type 1: Broadcast RF Coverage Based ............................. 3-156 3.5.7.1.2 User Zone Type 2: Broadcast Geo-based ......................................... 3-156 3.5.7.1.2.1 Circle .......................................................................................... 3-157 3.5.7.1.2.2 Segmented Linear....................................................................... 3-159 3.5.7.1.2.3 Polygon ...................................................................................... 3-161 3.5.7.1.3 User Zone Type 3: Mobile Specific RF Coverage Based - Overhead Parameter Determined ..................................................................................... 3-163 3.5.7.1.3.1 SID Only ..................................................................................... 3-163 3.5.7.1.3.2 SID and NID ............................................................................... 3-164 3.5.7.1.3.3 SID and BASE_ID ........................................................................ 3-165 3.5.7.1.3.4 Base Station Latitude and Longitude .......................................... 3-166 3.5.7.1.3.5 User Zone Center Point and Radius ............................................ 3-166 3.5.7.1.4 User Zone Type 4: Mobile Specific Geo-Based ................................. 3-167 3.5.7.1.5 User Zone Type 5: Mobile Specific Geo-Based Separate Carrier .... 3-167 3.5.7.1.6 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based ...... 3-169 vi

3GPP2 C.S0016-D v2.0

CONTENTS
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

3.5.7.1.6.1 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based System Information ....................................................................................... 3-175 3.5.7.1.6.1.1 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based System Information for 1x ............................................................................. 3-176 3.5.7.1.6.1.2 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based System Information for HRPD ....................................................................... 3-178 3.5.7.1.6.2 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based Acquisition Information ................................................................................. 3-179 3.5.7.1.6.2.1 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based Acquisition Information for 1x and HRPD ...................................................... 3-179 3.5.7.1.6.3 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based UZ RF Information .............................................................................................. 3-180 3.5.7.1.6.3.1 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based UZ RF Information for 1x .............................................................................. 3-181 3.5.7.1.6.3.2 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based UZ RF Information for HRPD ......................................................................... 3-184 3.5.8 3GPD Parameter Blocks................................................................................ 3-187 3.5.8.1 3GPD Operation Capability Parameters .................................................. 3-188 3.5.8.2 3GPD Operation Mode Parameters .......................................................... 3-189 3.5.8.3 Simple IP Capability Parameters ............................................................ 3-190 3.5.8.4 Mobile IP Capability Parameters ............................................................. 3-191 3.5.8.5 Simple IP User Profile Parameters ........................................................... 3-193 3.5.8.6 Mobile IP User Profile Parameters ........................................................... 3-195 3.5.8.7 Simple IP Status Parameters ................................................................... 3-198 3.5.8.8 Mobile IP Status Parameters ................................................................... 3-198 3.5.8.9 Simple IP PAP SS Parameters.................................................................. 3-199 3.5.8.10 Simple IP CHAP SS Parameters ............................................................. 3-200 3.5.8.11 Mobile IP SS Parameters ....................................................................... 3-201 3.5.8.12 HRPD Access Authentication Capability Parameters ............................. 3-202 3.5.8.13 HRPD Access Authentication User Profile Parameters ........................... 3-203 3.5.8.14 HRPD Access Authentication CHAP SS Parameters ............................... 3-204 3.5.8.15 eHRPD AKA Algorithm Capability Parameters ....................................... 3-205 3.5.8.16 eHRPD MILENAGE Algorithm Parameters ............................................. 3-205

vii

3GPP2 C.S0016-D v2.0

CONTENTS
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

3.5.9 MMD Parameter Block .................................................................................. 3-206 3.5.9.1 MMD Application Parameters .................................................................. 3-207 3.5.10 System Tag Parameter Blocks ..................................................................... 3-209 3.5.10.1 Home System Tag ................................................................................. 3-209 3.5.10.2 Group Tag List Dimensions ................................................................... 3-210 3.5.10.3 Group Tag List Parameter Block ........................................................... 3-211 3.5.10.4 Specific Tag List Dimensions ................................................................. 3-212 3.5.10.5 Specific Tag List Parameter Block ......................................................... 3-213 3.5.10.6 Call Prompt List Dimensions ................................................................. 3-214 3.5.10.7 Call Prompt Tag List Parameter Block ................................................... 3-215 3.5.11 Group Tag List, Specific Tag List and Call Prompt List ................................ 3-216 3.5.11.1 Group Tag List, Specific Tag List, and Call Prompt List CRC Calculation3-220 3.5.11.2 Group Tag Records ............................................................................... 3-220 3.5.11.2.1 Group Tag Record Format ............................................................... 3-220 3.5.11.2.1.1 Group Tag Record Single Entry ............................................... 3-220 3.5.11.2.1.2 Group Tag Record Range ........................................................ 3-222 3.5.11.3 Specific Tag Records ............................................................................. 3-224 3.5.11.3.1 Specific Tag Record Format ............................................................. 3-225 3.5.11.3.1.1 Specific Tag Record Single Entry ............................................. 3-225 3.5.11.3.1.2 Specific Tag Record Range ...................................................... 3-226 3.5.11.4 Call Prompt Record Format ................................................................ 3-228 3.5.12 MMS Parameter Block ................................................................................ 3-230 3.5.12.1 MMS URI Parameters ............................................................................ 3-230 3.5.12.2 MMS URI Capability Parameters ........................................................... 3-231 3.5.13 MMSS Configuration Parameter Blocks ...................................................... 3-232 3.5.13.1 AIR_INT_TYPE SUPPORTED Parameter Block ....................................... 3-232 3.5.13.2 MMSS MODE SETTINGS Parameter Block ............................................ 3-233 3.5.13.3 MMSS Location Associated Priority List (MLPL) Parameter Block .......... 3-234 3.5.13.4 MMSS System Priority List (MSPL) ........................................................ 3-240 3.5.13.5 MMSS WLAN Configuration Parameters ................................................ 3-245

viii

3GPP2 C.S0016-D v2.0

CONTENTS
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

4 BASE STATION PROCEDURES .................................................................................. 4-1 4.1 Reserved................................................................................................................. 4-1 4.2 Initiation of the Programming Procedures ............................................................... 4-1 4.2.1 User-Initiated Procedure ................................................................................... 4-1 4.2.2 Network-Initiated Procedure. ............................................................................ 4-2 4.3 Programming Data Download ................................................................................ 4-2 4.3.1 OTA Data Message Processing .......................................................................... 4-2 4.3.1.1 Configuration Request Message Processing ................................................. 4-3 4.3.1.2 Download Request Message Processing ....................................................... 4-3 4.3.1.3 Commit Request Message Processing .......................................................... 4-3 4.3.1.4 Re-Authenticate Request Message Processing ............................................. 4-3 4.3.1.5 MS Key Request Message Processing .......................................................... 4-3 4.3.1.6 Key Generation Request Message Processing .............................................. 4-3 4.3.1.7 Protocol Capability Request Message Processing ......................................... 4-3 4.3.1.8 SSPR Configuration Request Message Processing ....................................... 4-4 4.3.1.9 SSPR Download Request Message Processing ............................................. 4-4 4.3.1.10 Validation Request Message Processing .................................................... 4-4 4.3.1.11 OTAPA Request Message Processing ......................................................... 4-5 4.3.1.12 PUZL Configuration Request Message Processing...................................... 4-5 4.3.1.13 PUZL Download Request Message Processing ........................................... 4-5 4.3.1.14 3GPD Configuration Request Message Processing ..................................... 4-5 4.3.1.15 3GPD Download Request Message Processing ........................................... 4-5 4.3.1.16 Secure Mode Request Message Processing ................................................ 4-5 4.3.1.17 MMD Configuration Request Message Processing...................................... 4-6 4.3.1.18 MMD Download Request Message Processing ........................................... 4-6 4.3.1.19 System Tag Configuration Request Message Processing ............................ 4-6 4.3.1.20 System Tag Download Request Message Processing .................................. 4-6 4.3.1.21 Service Key Generation Request Message Processing ................................ 4-6 4.3.1.22 MMS Configuration Request Message Processing ...................................... 4-6 4.3.1.23 MMS Download Request Message Processing ............................................ 4-6

ix

3GPP2 C.S0016-D v2.0

CONTENTS
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

4.3.1.24 MMSS Configuration Request Message Processing .................................... 4-6 4.3.1.25 MMSS Download Request Message Processing .......................................... 4-7 4.3.2 SSD Update and re-authentication ................................................................... 4-7 4.3.3 Activation of Message Encryption ..................................................................... 4-7 4.3.4 Activation of Voice Privacy Mode ....................................................................... 4-7 4.3.5 Secure Mode ..................................................................................................... 4-8 4.3.5.1 Generation of Secure Mode Ciphering Key .................................................. 4-8 4.3.5.2 Encryption and Decryption of Messages in Secure Mode ............................. 4-9 4.3.6 Generation of Service Keys................................................................................ 4-9 4.3.6.1 Generation of Intermediate Key ................................................................... 4-9 4.3.6.2 Generation of Service Keys ........................................................................ 4-10 4.4 Termination of the Programming Procedure .......................................................... 4-10 4.5 Forward Link Message Formats ............................................................................ 4-11 4.5.1 Message Contents ........................................................................................... 4-13 4.5.1.1 Configuration Request Message ................................................................ 4-13 4.5.1.2 Download Request Message ...................................................................... 4-14 4.5.1.3 MS Key Request Message .......................................................................... 4-15 4.5.1.4 Key Generation Request Message .............................................................. 4-16 4.5.1.5 Re-Authenticate Request Message ............................................................ 4-17 4.5.1.6 Commit Request Message ......................................................................... 4-17 4.5.1.7 Protocol Capability Request Message ........................................................ 4-18 4.5.1.8 SSPR Configuration Request Message ....................................................... 4-19 4.5.1.9 SSPR Download Request Message ............................................................. 4-20 4.5.1.10 Validation Request Message .................................................................... 4-21 4.5.1.11 OTAPA Request Message ......................................................................... 4-22 4.5.1.12 PUZL Configuration Request Message ..................................................... 4-22 4.5.1.13 PUZL Download Request Message ........................................................... 4-24 4.5.1.14 3GPD Configuration Request Message .................................................... 4-25 4.5.1.15 3GPD Download Request Message .......................................................... 4-26 4.5.1.16 Secure Mode Request Message ................................................................ 4-27

3GPP2 C.S0016-D v2.0

CONTENTS
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

4.5.1.17 Reserved ................................................................................................. 4-28 4.5.1.18 MMD Configuration Request Message ..................................................... 4-28 4.5.1.19 MMD Download Request Message ........................................................... 4-29 4.5.1.20 System Tag Configuration Request Message ............................................ 4-30 4.5.1.21 System Tag Download Request Message ................................................. 4-31 4.5.1.22 Service Key Generation Request Message ................................................ 4-31 4.5.1.23 MMS Configuration Request Message ..................................................... 4-32 4.5.1.24 MMS Download Request Message ........................................................... 4-33 4.5.1.25 MMSS Configuration Request Message ................................................... 4-34 4.5.1.26 MMSS Download Request Message ......................................................... 4-35 4.5.2 NAM Parameter Blocks ................................................................................... 4-38 4.5.2.1 CDMA/Analog NAM Download .................................................................. 4-39 4.5.2.2 Mobile Directory Number .......................................................................... 4-41 4.5.2.3 CDMA NAM Download .............................................................................. 4-42 4.5.2.4 IMSI_T Parameter Block ............................................................................ 4-44 4.5.2.5 eHRPD IMSI Download ............................................................................. 4-45 4.5.3 SSPR Parameter Blocks .................................................................................. 4-46 4.5.3.1 Preferred Roaming List Parameter Block ................................................... 4-46 4.5.4 Validation Parameter Blocks ........................................................................... 4-47 4.5.4.1 Verify SPC ................................................................................................. 4-47 4.5.4.2 Change SPC .............................................................................................. 4-48 4.5.4.3 Validate SPASM ........................................................................................ 4-49 4.5.5 Reserved ......................................................................................................... 4-49 4.5.6 PUZL Parameter Blocks .................................................................................. 4-49 4.5.6.1 User Zone Insert and User Zone Update.................................................... 4-50 4.5.6.2 User Zone Delete....................................................................................... 4-51 4.5.6.3 User Zone Priority Change ........................................................................ 4-51 4.5.6.4 PUZL Flags ............................................................................................... 4-53 4.5.7 3GPD Parameter Blocks.................................................................................. 4-55 4.5.7.1 3GPD Operation Mode Parameters ............................................................ 4-56

xi

3GPP2 C.S0016-D v2.0

CONTENTS
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

4.5.7.2 Simple IP User Profile Parameters ............................................................. 4-56 4.5.7.3 Mobile IP User Profile Parameters ............................................................. 4-58 4.5.7.4 Simple IP Status Parameters ..................................................................... 4-61 4.5.7.5 Mobile IP Status Parameters ................................................................... 4-61 4.5.7.6 Simple IP PAP SS Parameters................................................................... 4-62 4.5.7.7 Simple IP CHAP SS Parameters ............................................................... 4-63 4.5.7.8 Mobile IP SS Parameters .......................................................................... 4-64 4.5.7.9 HRPD Access Authentication User Profile Parameters ............................... 4-65 4.5.7.10 HRPD Access Authentication CHAP SS Parameters ................................. 4-65 4.5.7.11 eHRPD MILENAGE Algorithm Parameters ............................................... 4-66 4.5.8 MMD Parameter Block .................................................................................... 4-67 4.5.8.1 MMD Application Parameters .................................................................... 4-67 4.5.9 System Tag Parameter Blocks ......................................................................... 4-69 4.5.9.1 Home System Tag Parameter Block ........................................................... 4-69 4.5.9.2 Group Tag List Parameter Block ............................................................... 4-71 4.5.9.3 Specific Tag List Parameter Block ............................................................. 4-73 4.5.9.4 Call Prompt List Parameter Block ............................................................. 4-74 4.5.10 MMS Parameter Block .................................................................................. 4-75 4.5.10.1 MMS URI Parameters .............................................................................. 4-75 4.5.11 MMSS Parameter Blocks............................................................................... 4-76 4.5.11.1 MMSS Mode Settings Parameter Block .................................................... 4-77 4.5.11.2 MMSS Location Associated Priority List (MLPL) Parameter Block ............ 4-77 4.5.11.3 MMSS System Priority List (MSPL) Parameter Block................................ 4-78 4.5.11.4 MMSS WLAN Download PARAM .............................................................. 4-81 5 KEY EXCHANGE PROCEDURES ............................................................................. 5-85 5.1 Mobile Station Requirements for A_KEY_P_REV < 00000011 .............................. 5-85 5.1.1 Random Number Generation .......................................................................... 5-85 5.1.2 Mobile Station Result...................................................................................... 5-85 5.1.3 A-key Computation ......................................................................................... 5-85 5.2 Base Station Requirements for A_KEY_P_REV < 00000011 ................................. 5-85

xii

3GPP2 C.S0016-D v2.0

CONTENTS
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

5.2.1 Generation of the Key Exchange Parameters ................................................... 5-85 5.2.2 Base Station Result ........................................................................................ 5-86 5.2.3 A-key Computation ......................................................................................... 5-86 5.3 Mobile Station Requirements for A_KEY_P_REV = 00000011 or 00000100 ........ 5-86 5.3.1 Random Number Generation for Diffie-Hellman Key Exchange Procedure....... 5-86 5.3.2 Mobile Station Result...................................................................................... 5-87 5.3.3 A-key and Root Key Computation for A_KEY_P_REV = 00000011 .................. 5-87 5.3.4 Root Key Computation for A_KEY_P_REV = 00000100................................... 5-87 5.4 Base Station Requirements for A_KEY_P_REV = 00000011 or 00000100 ........... 5-87 5.4.1 Generation of the Key Exchange Parameters Root Key .................................... 5-87 5.4.2 Base Station Result ........................................................................................ 5-88 5.4.3 A-key and Root Key Computation for A_KEY_P_REV = 00000011 .................. 5-88 5.4.4 Root Key K Computation for A_KEY_P_REV = 00000100 ............................... 5-89 5.5 Mobile Station Requirements for A_KEY_P_REV = 00000101 .............................. 5-89 5.5.1 Random Number Generation and Key Generation Parameters ........................ 5-89 5.5.2 Mobile Station Result...................................................................................... 5-89 5.5.3 Root Key Computation for A_KEY_P_REV = 00000101................................... 5-90 5.6 Base Station Requirements for A_KEY_P_REV = 00000101 ................................. 5-90 5.6.1 Random Number Generation and Key Generation Parameters ........................ 5-90 5.6.2 Base Station Result ........................................................................................ 5-91 5.6.3 3G Root Key K Computation ........................................................................... 5-91 5.7 Mobile Station Requirements for A_KEY_P_REV = 00000111 .............................. 5-92 5.7.1 Random Number Generation for Diffie-Hellman Key Exchange Procedure....... 5-92 5.7.2 Mobile Station Result...................................................................................... 5-92 5.7.3 eHRPD Root Key Computation for A_KEY_P_REV = 00000111 ....................... 5-92 5.8 Base Station Requirements for A_KEY_P_REV = 00000111 ................................. 5-92 5.8.1 Generation of the Key Exchange Parameters Root Key .................................... 5-92 5.8.2 Base Station Result ........................................................................................ 5-92 5.8.3 eHRPD Root Key eHRPD_K Computation for A_KEY_P_REV = 00000111 ....... 5-92 5.9 Mobile Station Requirements for A_KEY_P_REV = 00001000 .............................. 5-93

xiii

3GPP2 C.S0016-D v2.0

CONTENTS
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

5.9.1 Random Number Generation and Key Generation Parameters ........................ 5-93 5.9.2 Mobile Station Result...................................................................................... 5-93 5.9.3 eHRPD Root Key Computation for A_KEY_P_REV = 00001000 ....................... 5-93 5.10 Base Station Requirements for A_KEY_P_REV = 00001000 ............................... 5-94 5.10.1 Random Number Generation and Key Generation Parameters ...................... 5-94 5.10.2 Base Station Result ...................................................................................... 5-94 5.10.3 eHRPD Root Key eHRPD_K Computation ...................................................... 5-94 ANNEX A ANNEX B ANNEX C VOID ........................................................................................................ A-1 VOID ........................................................................................................ B-1 (INFORMATIVE) SYSTEM SELECTION AND ACQUISITION ....................... C-1

C.1 Introduction .......................................................................................................... C-1 C.2 Accelerated System Selection ................................................................................. C-2 C.2.1 Using Positive and Negative Systems ................................................................ C-2 C.2.2 PCS Block Mode System Selection .................................................................... C-3 C.2.3 Special Cases and Considerations .................................................................... C-3 C.3 Preferred Roaming List Maintenance ...................................................................... C-4 ANNEX D LIST ANNEX E (INFORMATIVE) SYSTEM SELECTION AND THE PREFERRED USER ZONE D-1 (INFORMATIVE) MULTIMODE SYSTEM SELECTION ................................ E-1

E.1 Introduction ........................................................................................................... E-1 E.1.1 MMSS Location Associated Priority List (MLPL) ................................................ E-1 E.1.2 MMSS System Priority List (MSPL).................................................................... E-4 E.1.2.1 MMSS System Priority List (MSPL) Example ............................................... E-8 E.1.2.2 MMSS System Priority List (MSPL) with Specific System_Types................... E-9 E.1.2.3 MMSS System Priority List (MSPL) Examples of Higher Priority Search TimeE-11

xiv

3GPP2 C.S0016-D v2.0

FIGURES Figure 2.2.1-1 OTASP Data Message Encapsulation ...................................................... 2-15 Figure 2.2.1-2 OTASP Data Message CRC ..................................................................... 2-16 Figure 2.2.2-1 OTASP Data Message Capsule Segmentation on the Forward Analog Voice Channel. ................................................................................................................. 2-17 Figure 2.2.2-2 OTASP Data Message Capsule Segmentation on the Reverse Analog Voice Channel .................................................................................................................. 2-18

1 2 3 4 5 6 7

xv

3GPP2 C.S0016-D v2.0

TABLES Table 3.2.2.2-1 Valid Service Configuration Attributes for Service Option 18 .................. 3-6 Table 3.2.2.2-2 Valid Service Configuration Attributes for Service Option 19 .................. 3-6 Table 3.3.6-1 Service Programming Code Values ........................................................... 3-43 Table 3.3.10.2-1 Key Identifier Table ............................................................................. 3-47 Table 3.5-1 Reverse Link Messages ............................................................................... 3-48 Table 3.5.1.2-1 Result Codes......................................................................................... 3-53 Table 3.5.1.7-1 Feature Identifier .................................................................................. 3-59 Table 3.5.1.7-2 Band/mode Capability Information ....................................................... 3-62 Table 3.5.1.13-1 UZ Type According to UZ_ID ............................................................... 3-68 Table 3.5.1.17.1-1 Capability Information Record Types................................................ 3-74 Table 3.5.1.17.1.1-1. OP_MODE .................................................................................... 3-75 Table 3.5.1.17.1.5-1. EXT_UIM_ID Field Setting ............................................................ 3-77 Table 3.5.2-1 NAM Parameter Block Types .................................................................... 3-90 Table 3.5.3-1 SSPR Parameter Block Types ................................................................. 3-99 Table 3.5.5.2-1 Acquisition Record Type Values .......................................................... 3-110 Table 3.5.5.2-2 Extended Acquisition Record Type Values ........................................... 3-111 Table 3.5.5.2.1.1-1 Cellular System A/B Selection Type Values .................................. 3-112 Table 3.5.5.2.1.2-1 Cellular CDMA and JTACS CDMA Standard Channel Selection Type Values .................................................................................................................. 3-113 Table 3.5.5.2.1.5-1 PCS CDMA Frequency Blocks ....................................................... 3-115 Table 3.5.5.2.1.7-1 JTACS CDMA Standard Channel Selection Type Values ................ 3-116 Table 3.5.5.3-1 NID_INCL Values ................................................................................ 3-128 Table 3.5.5.3.2-1 Type-specific system ID record ......................................................... 3-130 Table 3.5.5.3.2-2 Type-specific system ID record ......................................................... 3-132 Table 3.5.5.3.2-3 NID_INCL Values ............................................................................. 3-132 Table 3.5.5.3.2.2-1 Type-specific system ID record ...................................................... 3-135 Table 3.5.5.3.2.2-2 SYS_RECORD_SUBTYPE Values ................................................... 3-136 Table 3.5.5.3.2.2-3 Subtype Dependent record for Subtype 000 ................................ 3-136 Table 3.5.5.3.2.2-4 Subtype Dependent record for Subtype 001 ................................ 3-136 Table 3.5.5.3.2.2-5 Subtype Dependent record for Subtype 010 ................................ 3-137

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

xvi

3GPP2 C.S0016-D v2.0 TABLES

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

Table 3.5.5.3.2.2-6 Subtype Dependent record for Subtype 011 ................................ 3-138 Table 3.5.6-1. PUZL Parameter Block Types ............................................................... 3-140 Table 3.5.7-1 User Zone Type Values .......................................................................... 3-155 Table 3.5.7.1.2-1 Geo Type Values .............................................................................. 3-156 Table 3.5.7.1.3-1 Overhead Parameter (OHP) Type Values ........................................... 3-163 Table 3.5.8-1 3GPD Parameter Block Types ................................................................ 3-187 Table 3.5.8.2-1 Operation Mode .................................................................................. 3-189 Table 3.5.8.3-1 AUTH_ALGORITHM Parameter Values ................................................ 3-191 Table 3.5.8.4-1 MN-AAA_AUTH_ALGORITHM Parameter Values.................................. 3-192 Table 3.5.8.4-2 MN-HA_AUTH_ALGORITHM Parameter Values ................................... 3-193 Table 3.5.8.5-1 Authentication Algorithm Parameter Values for Simple IP ................... 3-194 Table 3.5.8.6-1 Authentication Algorithm Parameter Values........................................ 3-197 Table 3.5.8.12-1 AUTH_ALGORITHM Parameter Values .............................................. 3-203 Table 3.5.8.13-1 Authentication Algorithm Parameter Values...................................... 3-204 Table 3.5.9-1 MMD Parameter Block Types ................................................................. 3-206 Table 3.5.10-1 System Tag Parameter Block Types ...................................................... 3-209 Table 3.5.11.2-1 Group Tag Record Type Values ......................................................... 3-220 Table 3.5.11.3-1 Specific Tag Record Type Values ....................................................... 3-225 Table 3.5.12-1 MMS Parameter Block Types................................................................ 3-230 Table 3.5.13-1 MMSS Configuration Parameter Block Types ....................................... 3-232 Table 3.5.13.3-1 LOC_PARAM_TYPE ........................................................................... 3-236 Table 3.5.13.3-2 LOC_PARAM_VAL ............................................................................. 3-237 Table 3.5.13.4-1 System Type ..................................................................................... 3-242 Table 3.5.13.4-2 Higher Priority Search Time .............................................................. 3-243 Table 3.5.13.4-3 Network Capability ........................................................................... 3-244 Table 3.5.13.5-1 WLAN Air Interface Types.................................................................. 3-246 Table 4.3.6.2-1 Key Identifier Table ............................................................................... 4-10 Table 4.5-1 Forward Link Messages .............................................................................. 4-12 Table 4.5.1.22-1 Key Identifier Table ............................................................................. 4-32 Table 4.5.2-1 NAM Parameter Block Types .................................................................... 4-38 Table 4.5.3-1 SSPR Parameter Block Types ................................................................... 4-46

xvii

3GPP2 C.S0016-D v2.0

TABLES
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

Table 4.5.4-1 Validation Parameter Block Types ............................................................ 4-47 Table 4.5.4.1-1. BCD Mapping ..................................................................................... 4-48 Table 4.5.6-1 PUZL Parameter Block Types ................................................................... 4-50 Table 4.5.7-1 3GPD Parameter Block Types .................................................................. 4-55 Table 4.5.8-1 MMD Parameter Block Types ................................................................... 4-67 Table 4.5.9-1 System Tag Parameter Block Types ........................................................ 4-69 Table 4.5.10-1 MMS Parameter Block Types.................................................................. 4-75 Table 4.5.11-1 MMSS Download Parameter Block Types ............................................... 4-76 Table C.1-1 Preferred Roaming List ................................................................................. C-1 Table C.1-2 Acquisition Table .......................................................................................... C-1 Table C.1-3 System Table ................................................................................................ C-2 Table E.1.1-1 MLPL ......................................................................................................... E-1 Table E.1.1-2 MLPL using MNC ....................................................................................... E-2 Table E.1.1-3 MLPL with SYS_LOC TAG .......................................................................... E-3 Table E.1.1-5 MLPL with different levels of granularity .................................................... E-4 Table E.1.2-1 Simplified cdma2000 PRL example for one GEO ........................................ E-6 Table E.1.2-2 PLMN selector example .............................................................................. E-7 Table E.1.2.2-1 MSPL Example E.1.2.2-1 ........................................................................ E-9 Table E.1.2.2-2 MSPL Index 1 for Example E.1.2.2-2 .................................................... E-10 Table E.1.2.2-3 Simplified cdma2000 PRL for Example E.1.2.2-2 .................................. E-10 Table E.1.2.2-4 Simplified PLMN Selector List for Example E.1.2.2-2 ............................ E-10 Table E.1.2.2-5 MLPL for Example E.1.2.2-2 ................................................................. E-11 Table E.1.2.3-1 MSPL Example 1 for Higher Priority Search Time ................................. E-11 Table E.1.2.3-2 MSPL Example 2 for Higher Priority Search Time ................................. E-12 Table E.1.2.3-3 MSPL Example 3 for Higher Priority Search Time ................................. E-12

xviii

3GPP2 C.S0016-D v2.0 FOREWORD (This foreword is not part of this DocumentStandard) These technical requirements form a specificationstandard for Over-the-Air Service Provisioning of mobile stations. A mobile station operating in either the analog or the spread spectrum (CDMA) mode conforming with various versions of the CDMA standardairinterface specifications, such as TIA/EIA/IS-2000-A, TIA/EIA/IS-2000, TIA/EIA-95-B, TIA/EIA/IS-95-A (inclusive of TSB74), or ANSI J-STD-008 and this specificationstandard can be activated over the air in any system conforming with these specificationstandards. The scope of this standard specification covers over-the-air provisioning of mobile station operational parameters. This specificationstandard does not address the quality or reliability of Over-the-Air Service Provisioning, nor does it cover equipment performance or measurement procedures.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

SECTION SUMMARY 1. Introduction. This section defines the terms, references, protocols and network reference model used in this document. 2. Message Transmission Procedures. This section describes the lower-layer procedures used for transmission of messages for Over-the-Air Service Provisioning. 3. Mobile Station Procedures. This section describes the processing of messages received by the MS from the base station and the generation of messages to be transmitted by the MS to the base station.This section describes the mobile station procedures for Over-the-Air Service Provisioning. 4. Base Station Procedures. This section describes the processing of messages received by the Base Station from the MS and the generation of messages to be transmitted by the Base Station to the MS.This section describes the base station procedures for Over-the-Air Service Provisioning. 5. Key Exchange Procedures. exchange procedures. This section describes the requirements for key

xix

3GPP2 C.S0016-D v2.0 NOTES 1. The following verbal forms are used: Shall and shall not identify requirements to be followed strictly to conform to the standard and from which no deviation is permitted. Should and should not indicate that one of several possibilities is recommended as particularly suitable, without mentioning or excluding others; that a certain course of action is preferred but not necessarily required; or that (in the negative form) a certain possibility or course of action is discouraged but not prohibited. May and need not indicate a course of action permissible within the limits of the standard. Can and cannot are used for statements of possibility and capability, whether material, physical, or causal. 2. Footnotes appear at various points in this specification to elaborate and further clarify items discussed in the body of the specification. 3. Unless indicated otherwise, this document presents numbers in decimal form. Binary numbers are distinguished in the text by the use of single quotation marks. In some tables, binary values may appear without single quotation marks if table notation clearly specifies that values are binary. The character x is used to represent a binary bit of unspecified value. For example xxx00010 represents any 8-bit binary value such that the least significant five bits equal 00010. Hexadecimal numbers (base 16) are distinguished in the text by use of the form 0xhh where hh represents a string of hexadecimal digits. For example, 0x2fa1 represents a number whose binary value is 0010111110100001 and whose decimal value is 12193. Note that the exact number of bits in the binary representation of a hexadecimal number strictly depends on the implementation requirements for the variable being represented. 4. Numeric information is used to describe the operation of the mobile station. The following subscripts are used in this document to clarify the use of the numeric information: s indicates a value stored in a mobile stations temporary memory. r indicates a value received by a mobile station over a forward analog channel or a CDMA Forward Channel. p indicates a value set in a mobile stations permanent security and identification memory. s-p indicates a value stored in a mobile stations semi-permanent security and identification memory.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38

5. The term mobile station is equivalent to the term personal station. 56. IMSI_T Parameter Block does not apply for the mobile station conforming with TIA/EIA/IS-95-A (inclusive of TSB74) or ANSI J-STD-008. 67. IMSI_M in this document is equivalent to IMSI defined in TIA/EIA/IS-95-A (inclusive of TSB74) or ANSI J-STD-008.

xx

3GPP2 C.S0016-D v2.0 78. Each mobile station is assigned either a single unique 32-bit binary serial number (ESN) or a single unique 56-bit binary serial number (MEID) that cannot be changed by the subscriber without rendering the mobile station inoperative. 8. The vertical bar symbol (|) signifies concatenation of bit strings in this specification.

1 2 3 4

xxi

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36

The following standards contain provisions that, through reference in this text, constitute provisions of this Standard. At the time of publication, the editions indicated were valid. All standards are subject to revision, and parties to agreements based upon this Standard are encouraged to investigate the possibility of applying the most recent editions of the standards indicated below. ANSI and TIA maintain registers of currently valid national standards published by them. Normative References: 1. TIA-95-B, Mobile Station-Base Station Compatibility Standard for Wideband Spread Spectrum Cellular Systems, October 2004. 2. S.S0053-0, Common Cryptographic Algorithms, May 2009. 3. Reserved. 4. See Informative References. 5. C.S0002-E, Physical Layer Standard for cdma2000 Spread Spectrum Systems, September 2009. 6. C.S0004-E, Signaling Link Access Control (LAC) Standard for cdma2000 Spread Spectrum Systems, September 2009. 7. C.S0005-E, Upper Layer (Layer 3) Signaling Standard for cdma2000 Spread Spectrum Systems, September 2009. 8. S.S0055 Enhanced Cryptographic Algorithms, Rev. A, January 2002. 9. C.S0024-B, cdma2000 High Rate Packet Data Air Interface Specification, September 2009. 10. IETF RFC 1334, PPP Authentication Protocols, October 1992. 11. IETF RFC 1994, PPP Challenge Handshake Authentication Protocol (CHAP), August 1996. 12. IETF RFC 2002, IP Mobility Support, October 1996. 13. IETF RFC 2344, Reverse Tunneling for Mobile IP, August 1996. 14. IETF RFC 2486, The Network Access Interface, January 1999. 15. IETF RFC 3012, Mobile IPv4 Challenge/Response Extensions, November 1999. 16. National Bureau of Standards, Federal Information Processing Standards Publication 180-1; Secure Hash Standard, April 1995. 17. X.S0013, ALL-IP Core Network Multimedia Domain, December 2007 . 18. 3GPP TS 25.101, UE Radio Transmission and Reception (FDD), March 2003. 19. X.S0016-310, MMS MM1 Stage 3 Using OMA/WAP, July 2004. 20. X.S0016-311, MMS MM1 Stage 3 Using M-IMAP for Message Submission and Retrieval, May 2003. 21. X.S0016-312, MMS MM1 Using SIP, July 2004.

xxii

3GPP2 C.S0016-D v2.0 22. C.S0006-D, Analog Signaling Standard for cdma2000 Spread Spectrum Systems Release D, March 2004. 23. C.S0057-D, Band Class Specification for cdma2000 Spread Spectrum Systems, September 2009. 24. C.S0023-D, Removable User Identity Module for Spread Spectrum Systems, July 2009. 25. 3GPP TS 22.011 V7.9.0, Technical Specification Group Services and System Aspects; Service accessibility (Release 7), March 2008. 26. 3GPP TS 31.102 V7.12.0, Technical Specification Group Core Network and Terminals; Characteristics of the Universal Subscriber Identity Module (USIM) application (Release 7), March 2008. 27. C.S0084-0, Ultra Mobile Broadband Air Interface Specification, Parts 0 to 9, September 2007. 28. X.S0057, E-UTRAN - eHRPD Connectivity and Interworking: Core Network Aspects, April 2009. 29. 3GPP TS 35.205 V8.0.0, 3G Security; Specification of the MILENAGE algorithm set: An example algorithm set for the 3GPP authentication and key generation functions f1, f1*, f2, f3, f4, f5 and f5*; Document 1: General, December 2008. 30. National Institute of Standards and Technology: "Secure Hash Standard", FIPS 180-2, With Change Notice 1 dated February 2004, August 2002. 31. 3GPP TS 24.008 V8.7.0, Technical Specification Group Core Network and Terminals; Mobile radio interface Layer 3 specification; Core network protocols (Release 8), Sept 2009. 32. C.S0065-A, cdma2000 Application on UICC for Spread Spectrum Systems, August 17, 2009. See Informative References. See Informative References. 33. X.S0011-002-E v1.0, cdma2000 Wireless IP Network Standard: Simple IP and Mobile IP Access Services, Nov. 2009.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

xxiii

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9

Informative References: 4. C.R1001-G, Administration of Parameter Value Assignments for cdma2000 Spread Spectrum Standards, Release G, June 2009. 33. X.S0059 cdma2000 Femto-cell Network. C.S0024-300-C v2.0, Medium Access Layer for cdma2000 High Rate Packet Data Air Interface Specification, July, 2011.

xxiv

3GPP2 C.S0016-D v2.0

INTRODUCTION

2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

1.1 Scope Over-the-Air Service Provisioning (OTASP) consists of the following features provisioned over-the-air: Download of NAM operational parameters. Electronic Key Exchange for securely establishing the A-key and Root Key. System Selection for Preferred Roaming (SSPR) for providing mobile stations with information allowing acquisition of the preferred system in an area. Preferred User Zone List (PUZL) for providing mobile stations which support the optional User Zone feature with information allowing usage of the preferred user zone in an area. Download of 3G packet data operational parameters. Download of Multimode System Selection (MMSS) parameters.

Service Programming Lock (SPL), if provided, prevents the over-the-air provisioning of certain mobile station parameters by an unauthorized network entity. This document describes Over-the-Air Service Provisioning in CDMA and analog systems. The procedures defined are intended to be extendable and flexible enough to be used with future air interface specifications. The procedures in this document do not require support for continuation of the service provisioning process following a CDMA-to-analog handoff. 1.2 Terms and Numeric Information 1.2.1 Terms 3GPD. Third Generation Packet Data AC. See Authentication Center. Access Authentication. A procedure in which the Access Terminal (AT) is authenticated by the AN-AAA (Access Network Authentication, Authorization and Accounting entity). Access Point (AP). A station used for communicating with mobile stations. Depending upon the context, the term access point may refer to a base station [7], an access network [9], or a Femtocell Access Point (FAP) [33]. An access point may be capable of supporting multiple radio access technologies. Activation Code. A user-entered combination of a specified Feature Code (*FC) and defined group of at least two dialed digits (System Selection Code) that specify the user selection of a Band and a Block operated by the selected service provider. A-key. A secret, 64-bit pattern stored in the mobile station and HLR/AC. It is used to generate/update the mobile stations Shared Secret Data and to validate SPASM.

20

21 22 23 24 25 26 27 28 29 30 31 32 33 34

1-1

3GPP2 C.S0016-D v2.0 Analog Voice Channel. An analog channel on which a voice conversation occurs and on which brief digital messages may be sent from a base station to a mobile station or from a mobile station to a base station. Authentication. A procedure used by a base station to validate a mobile stations identity. Authentication Center (AC). related to the mobile station. An entity that manages the authentication information

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37

Base Station. A fixed station used for communicating with mobile stations. Depending upon the context, the term base station may refer to a cell, a sector within a cell, an MSC, an OTAF, or other part of the wireless system. (See also MSC and OTAF.) BCMCS Root Key. A secret 128-bit pattern used for BCMCS services. CRC. See Cyclic Redundancy Code. Cyclic Redundancy Code (CRC). A class of linear error detecting codes which generate parity check bits by finding the remainder of a polynomial division. Electronic Serial Number (ESN). A 32-bit number assigned by the mobile station manufacturer, uniquely identifying the mobile station equipment. eHRPD. See Evolved HRPD. eHRPD IMSI. IMSI used to identify eHRPD-capable stations in the land mobile service as specified in [28]. eHRPD Root Key for A_Key_P_REV = 00000111 or 00001000. A secret 128-bit pattern shared between the eHRPD mobile station and the Evolved Packet Core (EPC) network [28]. ESN. See Electronic Serial Number. Evolved HRPD (eHRPD). The eHRPD network supports attachment to the EPC (evolved packet core) of 3GPP. The eHRPD network optionally supports seamless handoffs between E-UTRAN and evolved HRPD with single-radio terminals. Forward CDMA Channel. A CDMA Channel from a base station to mobile stations. The Forward CDMA Channel contains one or more code channels that are transmitted on a CDMA frequency assignment using a particular pilot PN offset. Forward Analog Voice Channel (FVC). An analog voice channel used from a base station to a mobile station. Forward Traffic Channel. A code channel used to transport user and signaling traffic from the base station to the mobile station. FRESH. A 15-bit value used by the mobile station and the base station as the cryptographic synchronizer for encrypting parameter data in Secure Mode. FRESH may be set by the encrypting side to any value, including a monotonically incremented counter, as long as this value is not repeated for the duration of the Secure Mode in progress. HLR. See Home Location Register.

1-2

3GPP2 C.S0016-D v2.0 Home Location Register (HLR). The location register to which a MIN/IMSI is assigned for record purposes such as subscriber information. Home System. The cellular system in which the mobile station subscribes for service. HRPD. High Rate Packet Data. See [9]. IMPI. IMS Private Identity. See [17]. IMPU. IMS Public Identity. See [17]. IMS Root Key. A secret 128-bit pattern used for IMS services. IMSI. See International Mobile Station Identity. IMSI_M. MIN based IMSI using the lower 10-digits to store the MIN. IMSI_O. The operational value of IMSI used by the mobile station for operation with the base station. IMSI_T. IMSI not associated with MIN. 15-digits or fewer. International Mobile Station Identity (IMSI). A method of identifying stations in the land mobile service as specified in ITU-T Recommendation E.212. Location Grouping. A set of systems/networks associated with a geo-location. Long Code Mask. A 42-bit binary number that creates the unique identity of the long code. See also Public Long Code, Private Long Code, Public Long Code Mask and Private Long Code Mask. LSB. Least significant bit. MCC. See Mobile Country Code. MEID. See Mobile Equipment Identifier. MIN. See Mobile Identification Number. MMD. Multimedia Domain. MMS. Multimedia Messaging Service. MMSS. Multimode System Selection. MNC. See Mobile Network Code. Mobile Country Code (MCC). A part of the E.212 IMSI identifying the home country. See ITU-T Recommendation E.212. Mobile Equipment Identifier (MEID). A 56-bit number assigned by the mobile station manufacturer, uniquely identifying the mobile station equipment. Mobile Directory Number. A dialable directory number which is not necessarily the same as the mobile stations air interface identification, i.e., MIN, IMSI_M or IMSI_T. Mobile Identification Number (MIN). The 34-bit number that is a digital representation of the 10-digit number assigned to a mobile station.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

1-3

3GPP2 C.S0016-D v2.0 Mobile Network Code (MNC). A part of the E.212 IMSI identifying the home network within the home country. See ITU-T Recommendation E.212. Mobile Station. A station, fixed or mobile, which serves as the end users wireless communication link with the base station. Mobile stations include portable units (e.g., hand-held personal units) and units installed in vehicles. Mobile Station Originated Call. A call originating from a mobile station. Mobile Station Terminated Call. A call received by a mobile station (not to be confused with a disconnect or call release). Mobile Switching Center (MSC). A configuration of equipment that provides wireless radiotelephone service. Also called the Mobile Telephone Switching Office (MTSO). MSB. Most significant bit. MSC. See Mobile Switching Center. Multimode System Selection (MMSS). A feature that supports system selection across cdma20001 and non-cdma2000 systems based on a set of parameters stored in the mobile station in the form of a MMSS Location Associated Priority List (MLP_LISTs-p) and MMSS System Priority List (MSP_LISTs-p). NAM. See Number Assignment Module. Network. A network is a subset of a wireless system, such as an area-wide wireless network, a private group of base stations, or a group of base stations set up to handle a special requirement. A network can be as small or as large as needed, as long as it is fully contained within a system. See also System. Network Identification (NID). A number that uniquely identifies a network within a wireless system. See also System Identification. NID. See Network Identification. Number Assignment Module (NAM). A set of MIN/IMSI-related parameters stored in the mobile station. OTAF. See Over-the-Air Service Provisioning Function.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

Over-the-Air Service Provisioning Function (OTAF). A configuration of network equipment that controls OTASP functionality and messaging protocol. OTAPA. OTASP. See Over-the-Air Parameter Administration. See Over-the-Air Service Provisioning.

Over-the-Air Parameter Administration (OTAPA). Network initiated OTASP process of provisioning mobile station operational parameters over the air interface.

1 cdma2000 is the trademark for the technical nomenclature for certain specifications and

standards of the Organizational Partners (OPs) of 3GPP2. Geographically (and as of the date of publication), cdma2000 is a registered trademark of the Telecommunications Industry Association (TIA-USA) in the United States.

1-4

3GPP2 C.S0016-D v2.0 Over-the-Air Service Provisioning (OTASP). A process of provisioning mobile station operational parameters over the air interface. Parity Check Bits. Bits added to a sequence of information bits to provide error detection, correction, or both. P-CSCF. Proxy Call Session Control Function. Preferred User Zone List (PUZL). A list that provides the mobile station with the information for the User Zones to which the mobile user is subscribed. PDSN. Packet Data Service Node.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37

Private Long Code. The long code characterized by the private long code mask. Private Long Code Mask. The long code mask used to form the private long code. Pseudo-ESN (P-ESN). A 32-bit number derived from MEID and used in place of ESN. Pseudo-UIMID (P-UIMID). A 32-bit number derived from EUIMIDEUIM_ID using a specific algorithm. Public Long Code. The long code characterized by the public long code mask. Public Long Code Mask. The long code mask used to form the public long code. The mask contains the ESN of the mobile station. See also Private Long Code Mask. PUZL. See Preferred User Zone List. Release. A process that the mobile station and base station use to inform each other of call disconnect. Reverse CDMA Channel. The CDMA Channel from the mobile station to the base station. From the base stations perspective, the Reverse CDMA Channel is the sum of all mobile station transmissions on a CDMA frequency assignment. Roamer. A mobile station operating in a wireless system (or network) other than the one from which service was subscribed. Secure Mode. Network initiated mode of communicating operational parameters between a mobile station and network based provisioning entity in an encrypted form. SIP. Session Initiation Protocol. SMCK. Secure Mode Ciphering Key. Service Option. A service capability of the system. Service options may be applications such as voice, data, or facsimile. See [4]. Service Programming Code (SPC). A secret code assigned to the mobile station and known to the authorized network entity. Service Programming Lock (SPL). A protection provided for preventing the over-the-air provisioning of certain mobile station parameters by unauthorized network entity by way of verifying the Service Programming Code (SPC). Shared Secret Data (SSD). A 128-bit pattern stored in the mobile station (in semipermanent memory) and known by the base station. SSD is a concatenation of two 64-bit

1-5

3GPP2 C.S0016-D v2.0 subsets: SSD_A, which is used to support the authentication procedures, and SSD_B, which serves as one of the inputs to the process generating the encryption mask and private long code. SID. See System Identification. SPASM. See Subscriber Parameter Administration Security Mechanism. SPC. See Service Programming Code. SPL. See Service Programming Lock. SSD. See Shared Secret Data. SSPR. See System Selection for Preferred Roaming. Subscriber Parameter Administration Security Mechanism (SPASM). Security mechanism protecting parameters and indicators of active NAM from programming by an unauthorized network entity during the OTAPA session. System. A system is a wireless telephone service that covers a geographic area such as a city, metropolitan region, county, or group of counties. See also Network. System Identification (SID). A number uniquely identifying a wireless system. System Selection Code. A part of the Activation Code that specifies the user selection of a Band and a Block operated by the selected service provider. System Selection for Preferred Roaming (SSPR). A feature that enhances the mobile station system acquisition process based on the set of additional parameters stored in the mobile station in the form of a Preferred Roaming List (PR_LISTs-p). Traffic Channel. A communication path between a mobile station and a base station used for user and signaling traffic. The term Traffic Channel implies a Forward Traffic Channel and Reverse Traffic Channel pair. See also Forward Traffic Channel and Reverse Traffic Channel. UMB. Ultra Mobile Broadband. See [27] User Zone (UZ). CDMA Tiered Service Offerings are defined by User Zones that are geographical groupings of services. UZ. See User Zone. Voice Channel. See Analog Voice Channel. Voice Privacy. The process by which user voice transmitted over a CDMA Traffic Channel is afforded a modest degree of protection against eavesdropping over the air. WLAN Root Key. A secret 128-bit pattern used for WLAN services. 1.2.2 Numeric Information Numeric information is used to describe the operation of the mobile station. The following subscripts are used to clarify the use of the numeric information: s indicates a value stored in a mobile stations temporary memory.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

21 22 23 24 25 26 27 28 29 30 31 32

33 34 35 36

1-6

3GPP2 C.S0016-D v2.0 r indicates a value received by a mobile station over a forward analog control channel or a CDMA Forward Channel. p indicates a value set in a mobile stations permanent security and identification memory. s-p indicates a value stored in a mobile stations semi-permanent security and identification memory. This section defines numeric information specifically related to the OTASP. A_KEYP - A secret 64-bit pattern permanently stored in the mobile station. A_KEY_P_REVp - Protocol revision of the mobile station Key Exchange procedure. A_KEY_TEMPs - A secret 64-bit pattern temporarily stored in the mobile station. AUTH_OTAPAs - The computed 18-bit result AUTH_SIGNATURE used for validating SPASM. BCMCS_Kp - A secret 128-bit pattern permanently stored in the mobile station. BS_PARAM A variable used in the base station procedure for 3G Root Key computation. BS_PW A 128-bit user password that is stored in the base station. It has the same value as the MS_PW. BS_PW_HASH The computed 1152-bit hash of the base station user password BS_PW. BS_RESULT - Base station result CUR_MMSS_P_REVs-p - Protocol revision of the mobile stations current MMSS Lists. This information is used to parse MLP_LISTs-p and MSP_LISTs-p. Retained by the mobile station when the power is turned off. CDMABANDS. station [7]. CDMA band class. The CDMA band class currently used by the mobile

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

CDMACHS. CDMA Channel number. The CDMA Channel number currently used by the mobile station [7] [23]. CUR_PUZL_P_REVs-p Protocol revision of the mobile stations current preferred user zone list. This information is used to parse PUZLs-p. Retained by the mobile station when the power is turned off. CUR_SSPR_P_REVs-p Protocol revision of the mobile stations current preferred roaming list. This information is used to parse PRLs-p. Retained by the mobile station when the power is turned off. DATA_P_REVp - Protocol revision of the mobile station NAM Download procedure. eHRPD_Kp A secret 128-bit pattern permanently stored in the mobile station. eHRPD_K_TEMPs - A secret 128-bit pattern temporarily stored in the mobile station. G Generator for Diffie-Hellman key exchange procedure IMS_Kp - A secret 128-bit pattern permanently stored in the mobile station.

33 34

35 36

1-7

3GPP2 C.S0016-D v2.0 ITM_KEY An intermediate key used in the procedure for calculating service keys. MLP_LISTs-p MMSS Location Associated Priority List. Contains location information to assist the mobile station in multimode system selection. when the power is turned off. Retained by the mobile station

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

MMSS_P_REVp - Protocol revision of the mobile station MMSS Download procedure. MSP_LISTs-p MMSS System Priority List. Contains system priority information to assist the mobile station in multimode system selection. the power is turned off. Retained by the mobile station when

MS_PARAM A variable used in the mobile station procedure for 3G Root Key computation. MS_PW A 128-bit user password that is stored in the mobile station. It has the same value as the BS_PW. MS_PW_HASH The computed 1152-bit hash of the mobile station user password MS_PW. MS_RESULT - Mobile station result NAM_LOCKS-PNAM_LOCKp - The locking indicator set in the mobile station by the base station that defines SPASM protection of the programmable parameters in the active NAM during the OTAPA session. NULL - A value that is not in the specified range of the field or variable. NAM_LOCKs - A network controlled status of the SPASM protection of the active NAM for the subsequent OTAPA session. NAM_LOCK_STATE - a locking state of the mobile station programmable parameters for OTAPA. If the NAM_LOCK_STATE = 1, the parameters are locked for network initiated programming. P - Prime number for Diffie-Hellman key exchange procedure PARAM_G - Key exchange parameter G. PARAM_Gs - Key exchange parameter G. PARAM_P - Key exchange parameter P. PARAM_Ps - Key exchange parameter P. PR_LISTs-p - Preferred Roaming List. Contains information to assist the mobile station system selection and acquisition process. is turned off. Retained by the mobile station when the power

27 28 29 30 31 32 33 34 35 36 37

PRL_BLOCK_ID_CURRENTs Parameter Block Identifier for the current Preferred Roaming List temporarily stored in the mobile station. PUZLs-p Preferred User Zone List. Contains information to assist the mobile station during user zone selection and acquisition process. Retained by the mobile station when the power is turned off. PUZL_P_REVp - Protocol revision of the mobile station PUZL Download procedure.

1-8

3GPP2 C.S0016-D v2.0 RAND_SEED A secret 128-bit pattern temporarily stored in the mobile station. RKp - A secret 128-bit pattern permanently stored in the mobile station. RK_TEMPs - A secret 128-bit pattern temporarily stored in the mobile station. SPCp - Service Programming Code. A secret code assigned to the mobile station and known to the authorized network entity. The base station uses the code equal to the SPCp for unlocking the mobile station parameters for programming or reprogramming. SPCs - Service Programming Code temporarily stored in the mobile station. SPL_P_REVp - Protocol revision of the mobile station Service Programming Lock. SP_LOCK_STATE - A locking state of the mobile station programmable parameters. If the SP_LOCK_STATE = 1, the parameters cannot be programmed are locked for programming. SSDS A 128-bit pattern for Shared Secret Data temporarily stored in the mobile station. SSDS-P A 128-bit pattern for Shared Secret Data stored in the mobile station. Retained by the mobile station when the power is turned off. SSPR_P_REVp - Protocol revision of the mobile station SSPR Download procedure and the PRL format. SECURE_MODE_INDS- Secure Mode indicator. programming session is in Secure Mode. If SECURE_MODE_INDS = 1, current

1 2 3 4 5 6 7 8

9 10 11 12 13 14 15 16 17 18 19 20

SERVSYSS. Selected serving system indicator for Band Class 0. Set to SYS_A if the mobile station operates in system A; otherwise, set to SYS_B [7]. SMCKs Secure Mode Ciphering Key. WLAN_Kp - A secret 128-bit pattern permanently stored in the mobile station. X - Random number generated by mobile station Y - Random number generated by base station

21 22 23 24

25 26 27 28 29 30 31

1.2.3 Constants NULLPRL_BLOCK_ID The NULL value for PRL_BLOCK_ID_CURRENTS, defined as 01111111. NULLSMCK The NULL value for SMCKS, defined as a 128-bit field of all zeros. NULLSYS_TAG_BLOCK_ID The NULL value for SYS_TAG_BLOCK_ID_CURRENTS, defined as 01111111. NULLUZ_PRIORITY The NULL value for UZ_PRIORITY, defined as 1111.

1-9

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7

1.3 References The following specifcations contain provisions that, through reference in this text, constitute provisions of this document. At the time of publication, the editions indicated were valid. All specifications are subject to revision, and parties to agreements based upon this document are encouraged to investigate the possibility of applying the most recent editions of the specifications indicated below. ANSI and TIA maintain registers of currently valid national standards published by them.

9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

1.3.2 Normative References 1. TIA-95-B, Mobile Station-Base Station Compatibility Standard for Wideband Spread Spectrum Cellular Systems, October 2004. 2. 3GPP2 S.S0053-0 v2.0, Common Cryptographic Algorithms, May 2009. 3. Reserved. 4. See Informative References. 5. 3GPP2 C.S0002-E v3.0, Physical Layer Standard for cdma2000 Spread Spectrum Systems, June 2011. 6. 3GPP2 C.S0004-E v3.0, Signaling Link Access Control (LAC) Standard for cdma2000 Spread Spectrum Systems, June 2011. 7. 3GPP2 C.S0005-E v3.0, Upper Layer (Layer 3) Signaling Standard for cdma2000 Spread Spectrum Systems, June 2011. 8. 3GPP2 S.S0055 Enhanced Cryptographic Algorithms, Rev. A, January 2002. 9. 3GPP2 C.S0024-B v3.0, cdma2000 High Rate Packet Data Air Interface Specification, September 2009. 10. IETF RFC 1334, PPP Authentication Protocols, October 1992. 11. IETF RFC 1994, PPP Challenge Handshake Authentication Protocol (CHAP), August 1996. 12. IETF RFC 2002, IP Mobility Support, October 1996. 13. IETF RFC 2344, Reverse Tunneling for Mobile IP, August 1996. 14. IETF RFC 2486, The Network Access Interface, January 1999. 15. IETF RFC 3012, Mobile IPv4 Challenge/Response Extensions, November 1999. 16. National Bureau of Standards, Federal Information Processing Standards Publication 180-1; Secure Hash Standard, April 1995. 17. 3GPP2 X.S0013, ALL-IP Core Network Multimedia Domain. 18. 3GPP TS 25.101, UE Radio Transmission and Reception (FDD), March 2003. 19. 3GPP2 X.S0016-310-0 v2.0, MMS MM1 Stage 3 Using OMA/WAP, July 2004.

1-10

3GPP2 C.S0016-D v2.0 20. 3GPP2 X.S0016-311-0 v1.0, MMS MM1 Stage 3 Using M-IMAP for Message Submission and Retrieval, May 2003. 21. 3GPP2 X.S0016-312-0 v1.0, MMS MM1 Using SIP, July 2004. 22. 3GPP2 C.S0006-D v2.0, Analog Signaling Standard for cdma2000 Spread Spectrum Systems Release D, October 2005. 23. 3GPP2 C.S0057-E v1.0, Band Class Specification for cdma2000 Spread Spectrum Systems, October 2010. 24. 3GPP2 C.S0023-D v2.0, Removable User Identity Module for Spread Spectrum Systems, December 2011. 25. 3GPP TS 22.011 V7.9.0, Technical Specification Group Services and System Aspects; Service accessibility (Release 7), March 2008. 26. 3GPP TS 31.102 V7.12.0, Technical Specification Group Core Network and Terminals; Characteristics of the Universal Subscriber Identity Module (USIM) application (Release 7), March 2008. 27. 3GPP2 C.S0084-0 v3.0, Ultra Mobile Broadband Air Interface Specification, Parts 0 to 9, August 2008. 28. 3GPP2 X.S0057-A v1.0, E-UTRAN - eHRPD Connectivity and Interworking: Core Network Aspects, April 2011. 29. 3GPP TS 35.205 V8.0.0, 3G Security; Specification of the MILENAGE algorithm set: An example algorithm set for the 3GPP authentication and key generation functions f1, f1*, f2, f3, f4, f5 and f5*; Document 1: General, December 2008. 30. National Institute of Standards and Technology: Secure Hash Standard, FIPS 180-2, With Change Notice 1 dated February 2004, August 2002. 31. 3GPP TS 24.008 V8.7.0, Technical Specification Group Core Network and Terminals; Mobile radio interface Layer 3 specification; Core network protocols (Release 8), Sept 2009. 32. 3GPP2 C.S0065-B v2.0, cdma2000 Application on UICC for Spread Spectrum Systems, January 2011. 33. See Informative References. 34. See Informative References. 35. 3GPP2 X.S0011-002-E v1.0, cdma2000 Wireless IP Network Standard: Simple IP and Mobile IP Access Services, Nov. 2009. 36. See Informative References.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

1-11

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7

1.3.2 Informative References 4. 3GPP2 C.R1001-H, Administration of Parameter Value Assignments for cdma2000 Spread Spectrum Standards, July 2011. 33. 3GPP2 X.S0059 cdma2000 Femto-cell Network. 34. 3GPP2 C.S0024-300-C v2.0, Medium Access Layer for cdma2000 High Rate Packet Data Air Interface Specification, July, 2011.

1-12

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10

1.4 Requirements Language Shall and shall not identify requirements to be followed strictly to conform to this document and from which no deviation is permitted. Should and should not indicate that one of several possibilities is recommended as particularly suitable, without mentioning or excluding others, that a certain course of action is preferred but not necessarily required, or that (in the negative form) a certain possibility or course of action is discouraged but not prohibited. May and need not indicate a course of action permissible within the limits of the document. Can and cannot are used for statements of possibility and capability, whether material, physical or causal.

1-13

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10 11

This page left intentionally blank.No text.

1-14

3GPP2 C.S0016-D v2.0

MESSAGE TRANSPORT PROTOCOL

2 3 4 5 6 7 8 9 10 11

2.1 General OTASP Data Messages (see Sections 3 and 4) can be sent over the analog voice channel or the CDMA Traffic Channel. In either case, the OTASP Data Messages are sent using a Layer 2 protocol that provides reliable delivery and duplicate detection. The delivery of OTASP Data Messages does not require sequential delivery of messages by the Layer 2 protocol because the Over-the-Air Service Provisioning procedures ensure that only one OTASP Data Message is outstanding at any time. During the analog mode of operation, OTASP Data Messages are sent using the analog transport protocol (see 2.2). During the CDMA mode of operation, OTASP Data Messages are sent using the CDMA transport protocol (see 2.3). 2.2 Analog Transport Protocol OTASP Data Messages are transmitted over an analog voice channel using the OTASP Transport Message. Signaling on the analog voice channel does not have a Layer 2 protocol defined in [1, 1]. Because of the large amount of data transported for Over-the-Air Service Provisioning, this standard specification defines a Layer 2 protocol to ensure OTASP Data Message integrity. This protocol provides message segmentation, segment acknowledgment, error detection and re-transmission. 2.2.1 OTASP Data Message Encapsulation Each OTASP Data Message Unit transmitted on an analog voice channel shall consist of an 8-bit message length field (MSG_LENGTH), an OTASP Data Message, as defined in 3.5 and 4.5, and a 16-bit CRC, in that order (see Figure 2.2.1-1).
OTA SP Dat a Mes s a ge Ca ps u le

12 13 14 15 16 17 18

19 20 21 22

OTAS P Data Me s s age U n it

Pa d din g

8 MS G_LENG TH bits

a s requ ir ed

MS G _LENG TH

OTAS P Data Mes s a ge

CRC

23 24

8 bits

8 - 2 01 6 bits

1 6 b it s

Figure 2.2.1-1 OTASP Data Message Encapsulation

2-15

3GPP2 C.S0016-D v2.0 The MSG_LENGTH field shall be set to the number of octets in the OTASP Data Message plus three. The 16-bit CRC is calculated on the MSG_LENGTH field and the OTASP Data Message bits. The generator polynomial for this CRC shall be as follows: g(x) = x16 x12 x5 x0 The 16-bit CRC shall be computed according to the following procedure using the logic shown in Figure 2.2.1-2: Initially, all shift register elements shall be set to logical one and the switches shall be set in the position A. The register shall be clocked with each OTASP Data Message bit as an input, most significant bit first. The switches shall be set in the position B, and the register shall be clocked an additional 16 times. The 16 additional output bits shall be the CRC bits. The 16 CRC bits shall be transmitted in the order calculated.
Input A

1 2 3 4

5 6 7 8 9 10 11 12 13 14

1 B x0 x1 x5 x 12 x 15 A Output A

0 Denotes one-bit storage element Denotes modulo-2 addition

15 16 17 18 19 20

B Position A for first k bits Position B for last 16 bits

Figure 2.2.1-2 OTASP Data Message CRC Padding consisting of zero or more 0 bits shall be added immediately following the OTASP Data Message Unit. The length of the padding shall be such that the resulting OTASP Data Message Capsule fits into the minimum possible integral number of OTASP Transport Messages (see 2.2.2). 2.2.2 OTASP Data Message Segmentation Each OTASP Data Message Capsule (see 2.2.1) sent on an analog voice channel shall be segmented and transmitted in one or more OTASP Transport Messages, as defined in 2.2.3.4 and 2.2.4.3. Figures 2.2.2-1 and 2.2.2-2 illustrate the segmentation process for the forward and reverse analog voice channels, respectively.

21 22 23 24 25 26

2-16

3GPP2 C.S0016-D v2.0

Note: The Contents of the OTASP Data Message Capsule is segmented into OTASP_DATA fields of the Words 3 n of the OTASP Transport Message

OTASP Data Message Capsule

Segment 1

Segment 2

...
...

Segment N

OTASP_DATA fields for Word 3 of the OTASP Transport Message

OTASP_DATA fields for Word 4 of the OTASP Transport Message

OTASP_DATA fields for Word n of the OTASP Transport Message

Word 1

Word 2

Word 3

Word 4

...

Word n

OTASP Transport Message

1 2 3 4

Figure 2.2.2-1 OTASP Data Message Capsule Segmentation on the Forward Analog Voice Channel.

2-17

3GPP2 C.S0016-D v2.0

Note: The contents of the OTASP Data Message Capsule is segmented into the OTASP_DATA fields of Word 2-4 of the OTASP Transport Message Segment 1

Capsule OTASP Data Message

Segment 2

...

Segment N

OTASP_DATA fields for Word 2 of the OTAPA Transport Message

OTASP_DATA fields for Word 3 of the OTAPA Transport Message

OTASP_DATA fields for Word 4 of the OTAPA Transport Message

Word 1

Word 2

Word 3

Word 4

OTASP Transport Message

1 2 3

Figure 2.2.2-2 OTASP Data Message Capsule Segmentation on the Reverse Analog Voice Channel 2.2.3 Mobile Station Procedures OTASP Data Messages are sent and received on analog voice channels only when the mobile station is in the Conversation Task (see 2.6.4.4 of [1]). The mobile station shall transmit OTASP Transport Messages in accordance with the procedures in 2.7.2 of [1]. Mobile stations implementing the Over-the-Air Service Provisioning feature shall comply with the following requirements in addition to those of 2.6.4.4 of [1]. 2.2.3.1 OTASP Transport Message Acknowledgment and Re-transmission When the mobile station sends an OTASP Transport Message, it starts the OTASP acknowledgment timer. The timer is disabled when an OTASP Transport Confirmation Message is received. After sending an OTASP Transport Message, the mobile station shall not send a new OTASP Transport Message until it has received an OTASP Transport Confirmation Message acknowledging the message that has been sent. If the OTASP acknowledgment timer expires and the OTASP Transport Message has been sent fewer than three times, the mobile station shall resend the OTASP Transport Message and reset the OTASP acknowledgment timer to two seconds. If the OTASP acknowledgment timer expires and the OTASP Transport Message has been sent three times, the mobile station shall enter the Release Task (see 2.6.4.5 of [1]).

4 5 6 7 8 9

10 11 12 13 14 15 16 17 18 19 20 21

2-18

3GPP2 C.S0016-D v2.0 2.2.3.2 Message Transmission While the mobile station is in the Conversation Task, the following messages can be sent in addition to those listed in 2.6.4.4 of [1]: 1. OTASP Transport Message: After sending the message, the mobile station shall set the OTASP acknowledgment timer to two seconds. The mobile station shall construct the OTASP Transport Message as follows: If the OTASP_DATA field of the OTASP Transport Message contains an entire OTASP Data Message Capsule, the mobile station shall set TX_SEQ_NUMs to 00000, shall set the SEQ_NUM field equal to TX_SEQ_NUMs, and shall set the value of the B/F field to 11. If the OTASP_DATA field of the OTASP Transport Message contains the first segment of the segmented OTASP Data Message Capsule, the mobile station shall set TX_SEQ_NUMs to 00000, shall set the SEQ_NUM field equal to TX_SEQ_NUMs and shall set the value of the B/F field to 10. If the OTASP_DATA field of the OTASP Transport Message contains a segment other than the first segment of the segmented OTASP Data Message Capsule, the mobile station shall perform the following: If the OTASP_DATA field of the OTASP Transport Message contains a segment other than the final segment of the OTASP Data Message Capsule, the mobile station shall set TX_SEQ_NUMs to (TX_SEQ_NUMs + 1) modulo 32, shall set the SEQ_NUM field equal to TX_SEQ_NUMs and shall set the value of the B/F field to 00. If the OTASP_DATA field of the OTASP Transport Message contains the final segment of the OTASP Data Message Capsule, the mobile station shall set TX_SEQ_NUMs to (TX_SEQ_NUMs + 1) modulo 32, shall set the SEQ_NUM field equal to TX_SEQ_NUMs and shall set the value of the B/F field to 01.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

16 17 18 19 20 21 22 23 24 25 26 27

28 29 30 31

The mobile station shall remain in the Conversation Task. 2. OTASP Transport Confirmation Message: The mobile station shall set the SEQ_ACK field and DMU_CRC_OK field as specified in 2.2.3.3. The mobile station shall remain in the Conversation Task. 2.2.3.3 Message Reception While the mobile station is in the Conversation Task, the following messages can be received in addition to those listed in 2.6.4.4 of [1]. When any message is received, the mobile station shall perform all actions specified in 2.6.4.4 of [1] that apply to a message reception. The mobile station shall take the actions specified below for each message: 1. OTASP Transport Message: If the value of ESNr received in the OTASP Transport Message does not match the ESNp that identifies the mobile station, the mobile station shall turn off the

32 33 34 35 36 37 38 39

2-19

3GPP2 C.S0016-D v2.0 transmitter and then enter the Serving-System Determination Task (see 2.6.3.12 of [1]). If the value of ESNr received in the OTASP Transport Message matches the ESNp, the mobile station shall do the following: The mobile station shall send an OTASP Transport Confirmation Message within 750 ms after receiving the last bit of the OTASP Transport Message. The mobile station shall set the SEQ_ACK field equal to SEQ_NUMr received in the OTASP Transport Message. The mobile station shall set the DMU_CRC_OK field as specified below. If the value of the B/F field of the received message is 11, the OTASP_DATA field of the received message contains an OTASP Data Message Capsule in its entirety (i.e., contains an unsegmented OTASP Data Message Capsule). The mobile station shall discard any incomplete OTASP Data Message Capsule being reassembled. If the CRC of the OTASP Data Message Unit checks (see 2.2.1), the mobile station shall set the DMU_CRC_OK field of the OTASP Transport Confirmation Message to 1, and shall process the OTASP Data Message as specified in Section 3; otherwise, the mobile station shall set the DMU_CRC_OK field of the OTASP Transport Confirmation Message to 0, and shall discard the OTASP Data Message Capsule. If the value of the B/F field of the received message is 10, the mobile station shall discard any incomplete OTASP Data Message Capsule being reassembled, and shall store the OTASP_DATA field of the received message as the first segment of an OTASP Data Message Capsule to be reassembled. The mobile station shall set RX_SEQ_NUMs to the value of the SEQ_NUM field of the received message. The mobile station shall set the DMU_CRC_OK field of the OTASP Transport Confirmation Message to 0. If the value of the B/F field of the received message is 00 and a segmented OTASP Data Message Capsule is being reassembled, the mobile station shall perform the following: If (RX_SEQ_NUMs + 1) modulo 32 is equal to the value of the SEQ_NUM field of the received message, the mobile station shall store the OTASP_DATA field of the received message as the next segment of the OTASP Data Message Capsule being reassembled, and shall increment RX_SEQ_NUMs, modulo 32. If RX_SEQ_NUMs is equal to the value of the SEQ_NUM field of the received message, the mobile station shall discard the OTASP_DATA field of the received message. If neither RX_SEQ_NUMs nor (RX_SEQ_NUMs + 1) modulo 32 is equal to the value of the SEQ_NUM field of the received message, the mobile station shall discard the OTASP_DATA field of the received message and shall discard the incomplete OTASP Data Message Capsule being reassembled.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

2-20

3GPP2 C.S0016-D v2.0 The mobile station shall set the DMU_CRC_OK field of the OTASP Transport Confirmation Message to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

If the value of the B/F field of the received message is 00, and if no segmented OTASP Data Message Capsule is being reassembled, the mobile station shall discard the OTASP_DATA field of the received message. The mobile station shall set the DMU_CRC_OK field of the OTASP Transport Confirmation Message to 0. If the value of the B/F field of the received message is 01 and if a segmented OTASP Data Message Capsule is being reassembled, the mobile station shall perform the following: If (RX_SEQ_NUMs + 1) modulo 32 is equal to the value of the SEQ_NUM field of the received message, the mobile station shall store the OTASP_DATA field of the received message as the last segment of the OTASP Data Message Capsule being reassembled and shall increment RX_SEQ_NUMs, modulo 32. If the CRC of the OTASP Data Message Unit checks (see 2.2.1), the mobile station shall set the DMU_CRC_OK field of the OTASP Transport Confirmation Message to 1 and shall process the OTASP Data Message as specified in Section 3; otherwise, the mobile station shall set the DMU_CRC_OK field of the OTASP Transport Confirmation Message to 0 and shall discard the OTASP Data Message Capsule. If RX_SEQ_NUMs is equal to the value of the SEQ_NUM field of the received message, the mobile station shall discard the OTASP_DATA field of the received message. If the CRC of the OTASP Data Message Unit checks (see 2.2.1), the mobile station shall set the DMU_CRC_OK field of the OTASP Transport Confirmation Message to 1; otherwise, the mobile station shall set the DMU_CRC_OK field to 0. If neither RX_SEQ_NUMs nor (RX_SEQ_NUMs + 1) modulo 32 is equal to the value of the SEQ_NUM field of the received message, the mobile station shall discard the OTASP_DATA field of the received message and shall discard the incomplete OTASP Data Message Capsule being reassembled. The mobile station shall set the DMU_CRC_OK field of the OTASP Transport Confirmation Message to 0.

If the value of the B/F field of the received message is 01, and if no segmented OTASP Data Message Capsule is being reassembled, the mobile station shall discard the OTASP_DATA field of the received message. The mobile station shall set the DMU_CRC_OK field of the OTASP Transport Confirmation Message to 0.

The mobile station shall remain in the Conversation Task. 2. OTASP Transport Confirmation Message: If the SEQ_ACK field is equal to TX_SEQ_NUMs, the mobile station shall disable the OTASP acknowledgment timer; otherwise, the mobile station shall ignore the message. The mobile station shall remain in the Conversation Task.

2-21

3GPP2 C.S0016-D v2.0 2.2.3.4 Reverse Voice Channel Message Format 2.2.3.4.1 OTASP Transport Message When the mobile station sends the OTASP Transport Message on the Reverse Voice Channel (RVC), it shall use the following format: Word 1 of the OTASP Transport Message: Information Element F=1 NAWC T=1 MSG_TYPE=00000 ORDQ=000 ORDER=11010 SEQ_NUM B/F ESN_4 RSVD=0000 P
6 7

2 3 4 5

Length (bits) 1 2 1 5 3 5 5 2 8 4 12

Word 2 of the OTASP Transport Message: Information Element F=0 NAWC T=1 ESN_3 ESN_2 ESN_1 OTASP_DATA P 1 2 1 8 8 8 8 12 Length (bits)

2-22

3GPP2 C.S0016-D v2.0 Words 3 and 4 of the OTASP Transport Message: Information Element F=0 NAWC T=1 OTASP_DATA P
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

Length (bits) 1 2 1 32 12

F NAWC

First word field. The mobile station shall set this field to 1 in the first word of the message, and to 0 in all other words. Number of additional words coming field. The mobile station shall set this field in each word of the message to the number of remaining words not including the current word. T field. The mobile station shall set this field to 1. Message Type field. The mobile station shall set this field to 00000. Order qualifier field. The mobile station shall set this field to 000. Order field. The mobile station shall set this field to 11010. Message Sequence Number. The mobile station shall set this field to the message sequence number of this OTASP Transport Message. Begin/Final. This field is used to specify whether the OTASP Data Message Capsule has been segmented into multiple OTASP Transport Messages. If the OTASP Data Message Capsule is completely contained in a single OTASP Transport Message, the mobile station shall set this field to 11. For an OTASP Data Message Capsule contained in multiple OTASP Transport Messages, the mobile station shall set the value of this field in the first segment to 10, the value of this field in all intermediate segments to 00, and the value of this field in the final segment to 01. The mobile station shall set this field to the most significant octet (bits d31-d24) of the mobile station ESN. The mobile station shall set this field to the next to the most significant octet (bits d23-d16) of the mobile station ESN. The mobile station shall set this field to the next to the least significant octet (bits d15-d8) of the mobile station ESN. The mobile station shall set this field to the least significant octet (bits d7-d0) of the mobile station ESN.

T MSG_TYPE ORDQ ORDER SEQ_NUM B/F

ESN_4 ESN_3 ESN_2 ESN_1

2-23

3GPP2 C.S0016-D v2.0 RSVD OTASP_DATA P Reserved for future use; the mobile station shall set all bits as indicated. The mobile station shall set these fields to the corresponding octets of the OTASP Data Message Capsule. Parity field. 2.7.2 of [1]. The mobile station shall set this field as specified in

1 2 3 4 5 6

7 8 9

2.2.3.4.2 OTASP Transport Confirmation Message The mobile station Reverse Voice Channel (RVC) OTASP Transport Confirmation Message has the following format: Information Element F=1 NAWC=00 T=1 MSG_TYPE=00001 ORDQ=000 ORDER=11010 SEQ_ACK DMU_CRC_OK RSVD=0000000000000 P 1 2 1 5 3 5 5 1 13 12 Length (bits)

10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

F NAWC T MSG_TYPE ORDQ ORDER SEQ_ACK

First word field. The mobile station shall set this field to 1. Number of additional words coming field. The mobile station shall set this field to 00. T field. The mobile station shall set this field to 1.

Message Type field. The mobile station shall set this field to 00001. Order qualifier field. The mobile station shall set this field to 000. Order field. The mobile station shall set this field to 11010. Sequence Number for Acknowledgment by the OTASP Transport Confirmation Message. The mobile station shall set this field to the value of SEQ_NUM in the OTASP Transport Message being acknowledged. OTASP Data Message Unit CRC status flag. The mobile station shall set this field as specified in 2.2.3.2 to indicate whether or not the OTASP Data Message Unit CRC checks. Reserved for future use; the mobile station shall set all bits as indicated.

DMU_CRC_OK

RSVD

2-24

3GPP2 C.S0016-D v2.0 P Parity field. 2.7.2 of [1]. The mobile station shall set this field as specified in

1 2

3 4 5 6 7 8

2.2.4 Base Station Procedures OTASP Data Messages are sent and received on the analog voice channel only when the base station is in the Conversation Task (see 3.6.4.4 of [1]). The base station shall transmit OTASP Transport Messages as specified in 3.7.2 of [1]. Base stations implementing the Over-the-Air Service Provisioning feature should comply with the following requirements in addition to those of 3.6.4.4 of [1]. 2.2.4.1 Message Transmission While the base station is in the Conversation Task, the following messages can be sent in addition to those listed in 3.6.4.4 of [1]: 1. OTASP Transport Message: The base station should construct the OTASP Transport Message as follows: If the OTASP_DATA field of the OTASP Transport Message contains an entire OTASP Data Message Capsule, the base station should set the value of the SEQ_NUM field to 00000 and the value of the B/F field to 11. If the OTASP_DATA field of the OTASP Transport Message contains the first segment of the segmented OTASP Data Message Capsule, the base station should set the value of the SEQ_NUM field to 00000 and the value of the B/F field to 10. If the OTASP_DATA field of the OTASP Transport Message contains a segment other than the first segment of the segmented OTASP Data Message Capsule, the base station should perform the following: If the OTASP_DATA field of the OTASP Transport Message contains a segment other than the final segment of the OTASP Data Message Capsule, the base station should increment SEQ_NUM modulo 32 and should set the value of the B/F field to 00. If the OTASP_DATA field of the OTASP Transport Message contains the final segment of the OTASP Data Message, the base station should increment SEQ_NUM modulo 32 and should set the value of the B/F field to 01.

9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36

The base station should remain in the Conversation Task. 2. OTASP Transport Confirmation Message: The base station should set the SEQ_ACK field to the value of the SEQ_NUM field received in the OTASP Transport Message being acknowledged, and should remain in the Conversation Task.

2-25

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38

2.2.4.2 Message Reception While the base station is in the Conversation Task, the following messages can be received autonomously from the mobile station, in addition to those listed in 3.6.4.4 of [1]. When any message is received, the base station should perform all actions specified in 3.6.4.4 of [1] that apply to a message reception. The base station shall take the actions specified below for each message: 1. OTASP Transport Message: If the value of ESN received in the OTASP Transport Message does not match the ESN that identifies the mobile station being activated, the base station should ignore the message. If the value of ESN received in the OTASP Transport Message matches the ESN that identifies the mobile station being activated, the base station should do the following: The base station should send an OTASP Transport Confirmation Message. If the value of the B/F field of the received message is 11, the OTASP_DATA field of the received message contains the OTASP Data Message Capsule in its entirety. The base station may discard any incomplete OTASP Data Message being reassembled, and should process the OTASP Data Message as specified in Section 4. If the value of the B/F field of the received message is 10, the base station may discard any incomplete OTASP Data Message being reassembled, and should store the OTASP_DATA field of the received message as the first segment of an OTASP Data Message Capsule to be reassembled. The base station should store the value of the SEQ_NUM field of the received message in RX_SEQ_NUM. If the value of the B/F field of the received message is 00 and a segmented OTASP Data Message Capsule is being reassembled, the base station should perform the following: If (RX_SEQ_NUM + 1) modulo 32 is equal to the value of the SEQ_NUM field of the received message, the base station should store the OTASP_DATA field of the received message as the next segment of the OTASP Data Message being reassembled, and increment RX_SEQ_NUM modulo 32. If RX_SEQ_NUM is equal to the value of the SEQ_NUM field of the received message, the base station may discard the OTASP_DATA field of the received message. If neither RX_SEQ_NUM nor (RX_SEQ_NUM + 1) modulo 32 is equal to the value of the SEQ_NUM field of the received message, the base station may discard the OTASP_DATA field of the received message and may discard the incomplete OTASP Data Message being reassembled.

2-26

3GPP2 C.S0016-D v2.0 If the value of the B/F field of the received message is 00, and no segmented OTASP Data Message Capsule is being reassembled, the base station may discard the OTASP_DATA field of the received message. If the value of the B/F field of the received message is 01 and a segmented OTASP Data Message Capsule is being reassembled, the base station should perform the following: If (RX_SEQ_NUM + 1) modulo 32 is equal to the value of the SEQ_NUM field of the received message, the base station should store the OTASP_DATA field of the received message as the last segment of the OTASP Data Message Capsule being reassembled, should increment RX_SEQ_NUM modulo 32, and should process the OTASP Data Message as specified in Section 4. If RX_SEQ_NUM is equal to the value of the SEQ_NUM field of the received message, the base station may discard the OTASP_DATA field of the received message. If neither RX_SEQ_NUM nor (RX_SEQ_NUM + 1) modulo 32 is equal to the value of the SEQ_NUM field of the received message, the base station may discard the OTASP_DATA field of the received message and may discard the incomplete OTASP Data Message Capsule being reassembled.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

If the value of the B/F field of the received message is 01, and no segmented OTASP Data Message Capsule is being reassembled, the base station may discard the OTASP_DATA field of the received message.

The base station should remain in the Conversation Task. 2. OTASP Transport Confirmation Message: If SEQ_ACK is equal to the sequence number of the last OTASP Transport Message sent, the base station may transmit the next OTASP Transport Message; otherwise, the base station should ignore the message. If the DMU_CRC_OK field indicates that the CRC of the OTASP Data Message Unit did not check at the mobile station (see 2.2.3.3), the base station should resend the OTASP Data Message. The base station should remain in the Conversation Task. 2.2.4.3 Forward Voice Channel Message Format 2.2.4.3.1 OTASP Transport Message When the base station sends an OTASP Transport Message on the Forward Voice Channel (FVC), it shall use the following variable-length message format:

30

31 32 33

2-27

3GPP2 C.S0016-D v2.0 Word 1 of the OTASP Transport Message: Information Element T1T2 = 10 SCC=11 PSCC EF=0 SEQ_NUM DATA_WORDS MSG_TYPE=00000 ORDQ=000 ORDER=11010 P
2 3

Length (bits) 2 2 2 1 5 3 5 3 5 12

Word 2 of the OTASP Transport Message: Information Element T1T2 = 01 B/F ESN_4 ESN_3 ESN_2 P 2 2 8 8 8 12 Length (bits)

4 5

Word 3 of the OTASP Transport Message: Information Element T1T2 = 01 RSVD=00 ESN_1 OTASP_DATA P 2 2 8 16 12 Length (bits)

2-28

3GPP2 C.S0016-D v2.0 Word 4 through N of the OTASP Transport Message: Information Element T1T2 = 01 RSVD=00 OTASP_DATA P
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

Length (bits) 2 2 24 12

T1T2 SCC PSCC

Type field. The base station shall set this field to 10 in the first word of the message, and to 01 in all other words. SAT color code for new channel. The base station shall set this field to 11. Present SAT color code. The base station shall set this field to indicate the SAT color code associated with the present channel as specified in the Table 3.7.1.1-2 of [1]. Extended Protocol Forward Channel Indicator. The base station shall set this field to 0. Message Sequence Number. The base station shall set this field to the message sequence number of this OTASP Transport Message. The number of words in the OTASP Transport Message containing the OTASP_DATA field. The base station shall set this field to the number of words in the OTASP Transport Message, not including Word 1 and Word 2. Message Type field. The base station shall set this field to 00000. Order qualifier field. The base station shall set this field to 000. Order field. The base station shall set this field to 11010. Begin/Final. This field is used to specify whether the OTASP Data Message Capsule has been segmented into multiple OTASP Transport Messages. If the OTASP Data Message Capsule is completely contained in a single OTASP Transport Message, the base station shall set this field to 11. For an OTASP Data Message Capsule contained in multiple OTASP Transport Messages, the base station shall set the value of this field in the first segment to 10, the value of this field in all intermediate segments to 00, and the value of this field in the final segment to 01. The base station shall set this field to the most significant octet (bits d31-d24) of the mobile station ESN. The base station shall set this field to the next to the most significant octet (bits d23-d16) of the mobile station ESN.

EF SEQ_NUM DATA_WORDS

MSG_TYPE ORDQ ORDER B/F

ESN_4 ESN_3

2-29

3GPP2 C.S0016-D v2.0 ESN_2 ESN_1 OTASP_DATA RSVD P The base station shall set this field to the next to the least significant octet (bits d15-d8) of the mobile station ESN. The base station shall set this field to the least significant octet (bits d7-d0) of the mobile station ESN. The base station shall set these fields to the corresponding octets of the OTASP Data Message Capsule. Reserved for future use; the base station shall set all bits as indicated. Parity field. The base station shall set this field as specified in 3.7.2 of [1].

1 2 3 4 5 6 7 8 9 10

11 12 13 14

2.2.4.3.2 OTASP Transport Confirmation Message When the base station sends an OTASP Transport Confirmation Message on the Forward Voice Channel (FVC), it shall use the following fixed-length message format:

Information Element T1T2 = 10 SCC=11 PSCC EF=0 SEQ_ACK RSVD=000 MSG_TYPE=00001 ORDQ=000 ORDER=11010 P
15

Length (bits) 2 2 2 1 5 3 5 3 5 12

T1T2 SCC PSCC

Type field. The base station shall set this field to 10. SAT color code for new channel. The base station shall set this field to 11. Present SAT color code. The base station shall set this field to indicate the SAT color code associated with the present channel as specified in the Table 3.7.1.1-2 of [1]. Extended Protocol Forward Channel Indicator. The base station shall set this field to 0.

16 17 18 19 20 21 22

EF

2-30

3GPP2 C.S0016-D v2.0 SEQ_ACK Sequence Number for Acknowledgment by the OTASP Transport Confirmation Message. The base station shall set this field to the value of SEQ_NUM in the OTASP Transport Message being acknowledged. Message Type field. The base station shall set this field to 00001. Order qualifier field. The base station shall set this field to 000. Order field. The base station shall set this field to 11010. Reserved for future use; the base station shall set all bits as indicated. Parity field. The base station shall set this field as specified in 3.7.2 of [1].

1 2 3 4 5 6 7 8 9 10 11

MSG_TYPE ORDQ ORDER RSVD P

12 13 14 15 16 17 18 19 20 21 22 23 24

2.3 CDMA Transport Protocol The messages defined in 3.5 and 4.5 shall be sent in the CHARi fields of Data Burst Messages (see 6.7.2.3.2.4 and 7.7.3.3.2.4 of [1] and 2.7.2.3.2.4 and 3.7.3.3.2.4 of [1]). The BURST_TYPE field of Data Burst Messages carrying OTASP Data Messages shall be set to 000100 (as assigned in [4]). The MSG_NUMBER and NUM_MSGS fields shall be set to 1 and the NUM_FIELDS field shall be set to the number of octets in the OTASP Data Message. The base station should send Data Burst Messages carrying OTASP Data Messages only on CDMA Traffic Channels. Mobile stations shall ignore Data Burst Messages with the BURST_TYPE field equal to 000100 that are received on CDMA channels other than CDMA Traffic Channels. Data Burst Messages carrying OTASP Data Messages shall be sent as messages requiring Layer 2 acknowledgment (see 6.6.4.1.3.1 and 7.6.4.1.3.1 of [1] or as messages requiring delivery in assured mode see 1.3.2.1 and 1.3.2.2 of [7]).

2-31

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10

This page left intentionally blank.No text.

2-32

3GPP2 C.S0016-D v2.0

MOBILE STATION PROCEDURES

2 3 4 5 6 7 8 9 10

3.1 Initial Values and NAM Parameters Mobile stations support one or more Number Assignment Modules (NAM). The NAM includes certain numeric indicators, as defined in Annex F of [1, 1]. The standard NAM indicators, stored in the mobile stations permanent and semi-permanent memory, are defined in F.3 of [1, 1]. Manufacturer-specific NAM parameters may be defined within a Parameter Block Type reserved for manufacturer-specific parameter definitions (see Tables 3.5.2-1 and 4.5.2-1). Mobile stations supporting Service Programming Lock shall maintain a single additional indicator, SPCp (see 3.3.6). Mobile stations supporting the Over-the-Air Parameter Administration (OTAPA) shall maintain an additional indicator for each NAM, NAM_LOCKS-PNAM_LOCKp (see 3.2.2). The NAM indicators and parameters that can be assigned values using Over-the-Air Service Provisioning are specified in 4.5.2, 4.5.3, 4.5.4 and 4.5.6. Note that IMSI_M_PROGRAMMED and IMSI_T_PROGRAMMED, defined in [1] and [7], are set according to the rules defined in [24]. A mobile station shall have a single NAM selected for use at all times. If a mobile station supports more than one NAM, the mobile station manufacturer shall provide a means for the user to select the NAM to be activated. When a mobile station is manufactured, and whenever a NAM is created or cleared: IMSI_M_CLASSp shall be set to 0. MCC_Mp, IMSI_M_11_12p and IMSI_M_Sp shall be set to the coded value of the IMSI_M with the four least-significant digits set to ESNp, converted directly from binary to decimal, modulo 10000. The other digits shall be set to 0. IMSI_M_ADDR_NUMp shall be set to 000. IMSI_T_CLASSp shall be set to 0. MCC_Tp, IMSI_T_11_12p and IMSI_T_Sp shall be set to the coded value of the IMSI_T with the four least-significant digits set to ESNp, converted directly from binary to decimal, modulo 10000. The other digits shall be set to 0. IMSI_T _ADDR_NUMp shall be set to 000.

11 12

13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

ACCOLCp shall be set as specified in 6.3.5 of [1] or 2.3.5 of [1]. Apersistence[i], for terminals that also support HRPD, shall be set as specified in Sections 9.4.6.1.4.1.4 and 9.5.6.1.4.1.4 of [9]. HOME_SIDp, if present, shall be set to 0. All other indicators of the selected NAM may be set to manufacturer-defined default values. All configuration indicator values shall be set within their valid range (see F.3 of [1, 1]).

32 33 34

35 36 37

3-1

3GPP2 C.S0016-D v2.0 Mobile stations may perform any function allowable by applicable specificationsstandards, including system accesses, whether the selected NAM is activated or not.

1 2 3

4 5 6 7 8 9 10 11 12 13

3.2 Initiation of the Programming Procedures Over-the-air service provisioning (OTASP) can be initiated in two ways: by the user and by the network. The user-initiated procedure provides a tool for the mobile station user to select a wireless service provider, to activate a mobile station, and to update NAM indicators and parameters. The network-initiated procedure, also known as Over-The-Air Parameter Administration (OTAPA), is also built upon the over-the-air programming protocol and procedures that support the OTASP feature. OTAPA provides a tool for the wireless service provider to update NAM indicators and parameters. 3.2.1 User-Initiated Procedure The mobile station shall initiate programming procedures only when directed to do so by the user. The procedure for user initiation of the programming procedure is manufacturerdefined. Upon initiation of the programming procedure, the mobile station shall set PRL_BLOCK_ID_CURRENTs to NULLPRL_BLOCK_ID. As part of this procedure, the mobile station shall permit the user to enter a choice of the service provider. At a minimum, the mobile station shall permit the user to manually enter the activation code for the selected system using the following sequence: *FC + XX + SEND *FC XX Feature Code (*ACT or *228). This feature code indicates the activation call type to the base station. System Selection Code. This code indicates the system selected by the user. See Table 1.4-1 in [23].

14 15 16 17 18 19 20 21

22

23 24 25 26 27 28 29 30 31 32 33 34

The user may append additional digits after the System Selection Code. The activation code consists of the Feature Code, the System Selection Code and any additional digits that the user appends. The mobile station shall use the preferred roaming list to select the system if either of the following sets of conditions hold: Set #1: The mobile station supports the Service Programming Lock feature, and The SPCp is set to any value other than the default value (see 3.3.6), and The mobile station supports SSPR and the PR_LIST_SIZE is greater than zero (see 3.5.5).

35 36 37

Set #2:

3-2

3GPP2 C.S0016-D v2.0 The user has entered the feature code (*FC) only (no system selection code or any additional digits have been entered), and The mobile station supports SSPR and the PR_LIST_SIZE is greater than zero (see 3.5.5).

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38

Otherwise, the mobile station shall use the system selection code (see Table 1.4-1 in [23]) to acquire the system. When the user directs the mobile station to begin the programming procedure, and if the mobile station is not already monitoring a selected system, the mobile station shall enter the System Determination Substate of the Mobile Station Initialization State with a provisioning indication. If the mobile station enters the System Determination Substate of the Mobile Station Initialization State with a provisioning indication the mobile station shall perform the following: If a CDMA system with CDMABANDS = 00000 or 00011 is selected for provisioning, it shall perform the following
-

If the mobile station is to use System A, it shall set SERVSYSS to SYS_A. If the mobile station is to use System B, it shall set SERVSYSS to SYS_B. The mobile station shall set CDMACHS either to the Primary or Secondary CDMA Channel number (see [5]) for the selected serving system (SERVSYSS). If the mobile station fails to acquire a CDMA system on the first CDMA Channel it tries, the mobile station should attempt to acquire on the alternate CDMA Channel (Primary or Secondary) for the selected serving system before attempting other alternatives. If a CDMA system with CDMABANDS = 00000 is selected for provisioning and if the mobile station fails to acquire a CDMA system on either the Primary or Secondary CDMA Channel for the selected serving system (SERVSYSS), the mobile station may attempt to acquire an analog system as specified in [22], using the current setting of SERVSYSS.

If a CDMA system with CDMABANDS other than 00000 or 00011 is selected for provisioning, it shall perform the following: The mobile station shall set CDMACHS to a preferred CDMA Channel number (see [5]) within the selected frequency block. If the mobile station fails to acquire a CDMA system on the preferred CDMA channel it tries, the mobile station should set CDMACHS to an alternate preferred CDMA Channel number within the selected frequency block and should attempt to acquire a CDMA system. The mobile station should continue attempting to acquire different preferred CDMA Channels until it acquires a CDMA system or until it exhausts all preferred CDMA Channels within the selected frequency block.

3-3

3GPP2 C.S0016-D v2.0 If the mobile station fails to acquire a system, or if the selected band is not supported by the mobile station, the mobile station shall terminate the programming procedure and shall retain the NAM indicator values and parameters specified in 3.1, in effect prior to the initiation of the programming procedure.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

Once the selected system is acquired, the mobile station shall originate a call as follows: If the mobile station is in the CDMA mode, the mobile station shall perform the Mobile Station Origination Operation, as defined in 6.6.2.5 of [1] or 2.6.2.5 of [1], using the activation code as the dialed digits. The mobile station should request either a voice or an async data service option in the Origination Message. The mechanism used for the service option selection (either voice or async data) is vendor specific. The mobile station shall format each message sent on the CDMA Access Channel, Enhanced Access Channel, or Reverse Common Control Channel using an MSID field format that contains the mobile stations ESN or MEID.2 If the mobile station is in the analog mode, the mobile station shall enter the System Access Task with an origination indication, using the activation code as the dialed digits. Regardless of the value of the Ss bit, the mobile station shall send Serial Number Word C in all Reverse Analog Control Channel messages. If the mobile station responds to a page and the mobile station does not support concurrent services, the mobile station shall terminate the programming procedure and shall retain the NAM indicator values and parameters, specified in 3.1, in effect prior to the initiation of the programming procedure. If the mobile station does not support Service Programming Lock, the mobile station shall set mobile station locking state SP_LOCK_STATE to 0. If the mobile station supports Service Programming Lock, and if SPCp is equal to 0 (the default value), the mobile station shall set SP_LOCK_STATE to 0; otherwise, the mobile station shall set SP_LOCK_STATE to 1. The mobile station shall set SPCs = SPCp. When the mobile station supports OTAPA and the programming session was initiated by the user, the mobile station shall set the NAM_LOCK_STATE to 0 to indicate that SPASM does not protect access to the NAM parameters and indicators.

30 31 32

systems defined in [1] or [7], this means the MSID_TYPE field must be set to 000 or 011. For systems defined in [1] or [7], the use of a pseudo ESN can potentially conflict with another pseudo ESN in the network performing the mobile provisioning. The system should implement protective procedures to guard against this case. 3-4

2For

3GPP2 C.S0016-D v2.0 3.2.2 Network-Initiated Procedure An OTAPA-capable mobile station should support a manufacturer-specific means by which the user may disable and enable OTAPA for a given NAM. OTAPA should be enabled by default. When enabled, OTAPA may be initiated by the network. OTAPA procedures can be conducted when the mobile station is in the CDMA Conversation Substate or the analog Conversation Task (see 3.2.2.3). All OTASP Data Messages during the OTAPA session are exchanged between the base station and the mobile station using signaling traffic. If the mobile station is in the CDMA Mobile Station Idle State the base station can place the mobile station on the CDMA Traffic Channel for the purpose of conducting OTAPA procedure (see 3.2.2.1). 3.2.2.1 Initiation of OTAPA in the CDMA Mobile Station Idle State The network can initiate OTAPA by placing a mobile terminated call to the mobile station indicating the OTAPA service option in the General Page Message. The OTAPA Service Option when using Multiplex Option 1 is called Service Option 18. The OTAPA Service Option when using Multiplex Option 2 is called Service Option 19. The mobile station shall respond to paging as defined in 6.6 of [1] or 2.6 of [1] and perform service negotiation. 3.2.2.2 Connection of the OTAPA Service Option A service option is connected when primary traffic data are being processed in accordance with the requirements of the service option. The negotiated service configuration shall include only valid attributes for the negotiated service option consistent with those specified in Tables 3.2.2.2-1 and 3.2.2.2-2.

1 2 3 4 5 6 7 8 9 10 11

12 13 14 15 16 17

18 19 20 21 22

3-5

3GPP2 C.S0016-D v2.0 Table 3.2.2.2-1 Valid Service Configuration Attributes for Service Option 18 Service Configuration Attribute Forward Multiplex Option Reverse Multiplex Option Forward Transmission Rates Reverse Transmission Rates Forward Traffic Type Reverse Traffic Type Valid Selections Multiplex Option 1 Multiplex Option 1 Rate Set 1 with all four rates enabled Rate Set 1 with all four rates enabled None. This service option does not use nor generate any forward traffic other than signaling. None. This service option does not use nor generate any reverse traffic other than signaling.

Table 3.2.2.2-2 Valid Service Configuration Attributes for Service Option 19 Service Configuration Attribute Forward Multiplex Option Reverse Multiplex Option Forward Transmission Rates Reverse Transmission Rates Forward Traffic Type Reverse Traffic Type Valid Selections Multiplex Option 2 Multiplex Option 2 Rate Set 2 with all four rates enabled Rate Set 2 with all four rates enabled None. This service option does not use nor generate any forward traffic other than signaling. None. This service option does not use nor generate any reverse traffic other than signaling.

4 5 6 7 8 9 10 11 12 13 14 15 16 17

If the mobile station accepts a service configuration, as specified in a Service Connect Message, that includes a service option connection using Service Option 18 or 19, then the service option connection shall become part of the current service configuration at the action time associated with the Service Connect Message. Service Option 18 or 19 is considered connected when the current service configuration includes a service option connection for it. If Service Option 18 or 19 is connected when the mobile station enters the Waiting for Mobile Station Answer Substate, or while the mobile station is in the Waiting for Mobile Station Answer Substate, the mobile station shall send a Connect Order to the base station as a message requiring acknowledgment without waiting for the user to explicitly command the call to be answered. The mobile station shall enter the Conversation Substate. When Service Option 18 or 19 is connected, the Service Option shall discard all primary traffic data bits received from the multiplex sublayer, and the mobile station shall transmit null traffic channel data.

3-6

3GPP2 C.S0016-D v2.0 3.2.2.3 Starting the OTAPA session If the mobile station supports OTAPA and OTAPA is enabled (see 3.2.2), the mobile station shall start the OTAPA session when it receives the OTAPA Request Message with the START_STOPr equal to 1, while in the CDMA Conversation Substate or the analog Conversation Task. Upon starting the OTAPA session, the mobile station shall set PRL_BLOCK_ID_CURRENTs to NULLPRL_BLOCK_ID. During the OTAPA session, access to individual parameters of the active NAM is controlled by the Subscriber Parameter Administration Security Mechanism (SPASM). If the programming session was initiated by the user as described in 3.2.1, SPASM does not protect access to the NAM parameters and indicators; otherwise, upon invocation of the OTAPA session the mobile station shall set the NAM_LOCKs = NAM_LOCKS-PNAM_LOCKp and NAM_LOCK_STATE = NAM_LOCKS-PNAM_LOCKp. The NAM_LOCK_STATE being set to 0 indicates that SPASM protection of the mobile stations active NAM is disabled. The NAM_LOCK_STATE being set to 1 indicates that SPASM protection of the mobile stations active NAM is enabled. If the mobile station does not support Service Programming Lock, the mobile station shall set mobile station locking state SP_LOCK_STATE to 0. If the mobile station supports Service Programming Lock, and if SPCp is equal to 0 (the default value), the mobile station shall set SP_LOCK_STATE to 0; otherwise, the mobile station shall set SP_LOCK_STATE to 1. The mobile station shall set SPCs = SPCp. 3.3 Programming Procedure 3.3.1 OTASP Data Message Processing The mobile station shall discard all OTASP Data Messages received, if the programming procedure is not initiated as described in 3.2 or when the mobile station is in any state, substate or task other than the CDMA Conversation Substate or the analog Conversation Task. If the mobile station is in the Mobile Station Control on the Traffic Channel State, the mobile station shall send the Mobile Station Reject Order with ORDQ equal to 00000010. While in the CDMA Conversation Substate or the analog Conversation Task, the mobile station shall process OTASP Data Messages as described in the following sub-sections. If the mobile station receives an OTASP Data Message that it does not recognize or which requires a capability that is not supported, the mobile station shall discard the message and shall send a Mobile Station Reject Order with ORDQ set to 00000110 within T56m seconds (see [7]). The mobile station shall ignore bits at the end of an OTASP Data Message that do not exist in the revision of this specification supported by the mobile station.follows:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

23

24 25 26 27 28 29 30 31 32 33 34 35 36 37

3-7

3GPP2 C.S0016-D v2.0 3.3.1.1 Configuration Request Message Processing 1. Configuration Request Message: The mobile station shall send a Configuration Response Message within 750 ms after receiving the message. If either SP_LOCK_STATE = 1, or NAM_LOCK_STATE = 1, or both are set to 1, the mobile station shall set the RESULT_CODE in all corresponding returned confirmation blocks to 00001010, Rejected - Mobile station locked. The mobile station shall include all requested parameter blocks with the BLOCK_LEN field set to 00000000. If both SP_LOCK_STATE and NAM_LOCK_STATE are set to 0, then: If the mobile station does not support a requested parameter block, the mobile station shall set RESULT_CODE in the corresponding returned confirmation block to 00000111, Rejected - BLOCK_ID value not supported. The mobile station shall include the parameter block with the BLOCK_LEN field set to 00000000. If the requested data blocks exceed the allowable message length, the mobile station shall set RESULT_CODE in the corresponding returned confirmation block to 00000000, Accepted - Operation successful for each Parameter Block included in the message. The mobile station shall include data blocks, in the order requested, up to the maximum number of blocks that fit into the message. If SECURE_MODE_INDS = 1, the mobile station shall set the FRESH_INCL field to 1, include the FRESH field and set it to a 15-bit value selected according to 3.3.8. The mobile station shall encrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks included in the Configuration Response Message. All the encrypted Parameter Blocks and FRESH field shall fit into the Configuration Response Message. Otherwise, the mobile station shall set RESULT_CODE to 00000000, Accepted - Operation successful for each Parameter Block included in the corresponding confirmation block. The mobile station shall include complete data blocks, in the order requested, in the Configuration Response Message. If SECURE_MODE_INDS = 1, the mobile station shall set the FRESH_INCL field to 1, include the FRESH field and set it to a 15-bit value selected according to 3.3.8. The mobile station shall encrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks included in the Configuration Response Message.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35

36 37 38

3.3.1.2 Download Request Message Processing 2. Download Request Message: The mobile station shall respond to the message with a Download Response Message within 750 ms.

3-8

3GPP2 C.S0016-D v2.0 If FRESH_INCLr = 1 and the SECURE_MODE_INDS = 1, the mobile station shall set FRESHS = FRESHr and decrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks received in the Download Request Message. If the Download Request Message contains an OTASP Parameter Block with a BLOCK_ID that is not supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000111, Rejected - BLOCK_ID value not supported; If the Download Request Message contains an OTASP Parameter Block having a size different from that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000010, Rejected - Data size mismatch; If the Download Request Message contains an OTASP Parameter Block with a parameter value that is out-of-range, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000100, Rejected - Invalid parameter; If the Download Request Message contains an OTASP Parameter Block with N_SID_NIDMAX_SID_NID larger than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000101, Rejected - SID/NID length mismatch; If the Download Request Message is not accepted for any other reason, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000001, Rejected - Unknown reason; Otherwise, the mobile station shall store the message data in temporary memory, set BLOCK_ID to the received parameter block identifier and set RESULT_CODE to 00000000, Accepted - Operation successful. Then, if the mobile station supports the optional NAM indicators (see F.3 of [1, 1]), the mobile station should also store values for CDMA_PREF_SERVp and ANALOG_PREF_SERVp equal to the serving system selected for activation in temporary memory. If more than one Download Request Message or parameter block is received containing values for the same indicators, the mobile station shall retain only the most recently received values. If the received data includes SID/NID pairs, the mobile station shall retain only the SID/NID pairs from the most recently received message. 3.3.1.3 Commit Request Message Processing 3. Commit Request Message: The mobile station shall send a Commit Response Message within 10 seconds after receiving the message. If either SP_LOCK_STATE = 1, or NAM_LOCK_STATE = 1, or both are set to 1, the mobile station shall not move data from temporary memory to permanent memory. The mobile station shall set RESULT_CODE to 00001010, Rejected - Mobile station locked; otherwise,

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

35 36 37 38 39 40 41

3-9

3GPP2 C.S0016-D v2.0 If the mobile station is able to move data from temporary memory to permanent memory successfully, the mobile station shall set the RESULT_CODE to 00000000, Accepted - Operation successful. If the mobile station is not able to move data from temporary memory to permanent memory for any other reason, the mobile station shall set the RESULT_CODE to 00000001, Rejected - Unknown reason. If the mobile station has received configuration parameters in one or more Download Request Messages, it shall set the NAM indicators to the values contained in the received configuration parameters data. The mobile station shall not change the value of any NAM indicator for which no data has been received. If the received data includes SID/NID pairs, the mobile station shall set the NAM indicators to include only the SID/NID pairs received. If the mobile station has received Preferred Roaming List parameters in one or more SSPR Download Request Messages, it shall set the permanent Preferred Roaming List parameters to the values contained in the received data. The mobile station shall set the CUR_SSPR_P_REVs-p according to the following rules: If PRL_BLOCK_ID_CURRENTs is set to 00000000 (Preferred Roaming List Parameter Block), then the mobile station shall set the CUR_SSPR_P_REVs-p to 00000001. If PRL_BLOCK_ID_CURRENTs is set to 00000001 (Extended Preferred Roaming List Parameter Block), then the mobile station shall set the CUR_SSPR_P_REVs-p to the value of CUR_SSPR_P_REV in the Extended Preferred Roaming List (see Section 3.5.5).

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39

If the mobile station has received 3GPD parameters in one or more 3GPD Download Request Messages, it shall set the permanent 3GPD parameters to the values contained in the received data. If the mobile station has received Preferred User Zone List parameters in one or more PUZL Download Request Messages, it shall set the permanent Preferred User Zone List parameters to the values contained in the received data. If the mobile station has received User Zone Delete parameter blocks in one or more PUZL Download Request Messages, it shall remove the identified user zone entry(s) from the current Preferred User Zone List. If the received data includes SID/NID pairs, the mobile station shall set the NAM indicators to include only the SID/NID pairs received. If the mobile station has stored A_KEY_TEMPs after receiving a Key Generation Request Message, it shall set the value of the A_KEYp NAM indicator equal to A_KEY_TEMPs.

3-10

3GPP2 C.S0016-D v2.0 If the mobile station has stored RK_TEMPs after receiving a Key Generation Request Message, it shall set the value of the RKp NAM indicator equal to RK_TEMPs. If the mobile station has stored eHRPD_K_TEMPs after receiving a Key Generation Request Message, it shall set the value of the eHRPD_Kp NAM indicator equal to eHRPD_K_TEMPs. If the mobile station has generated the SSDs as a result of an SSD update procedure based on the A_KEY_TEMPs, the mobile station shall store the SSDs in SSDs-p. If the mobile station has stored temporary service keys after receiving a Service KeyGeneration Request Message, it shall store the service keys to permanent memory. If the mobile station has stored the SPCs after receiving a Validation Request Message, it shall set the value of the SPCp parameter equal to SPCs. If the mobile station has stored the NAM_LOCKs after receiving a Validation Request Message, it shall set the value of the NAM_LOCKS-PNAM_LOCKp parameter equal to NAM_LOCKs. If the mobile station has received System Tag List parameters in one or more System Tag Download Request Messages, it shall set the permanent System Tag List parameters to the values contained in the received data. The mobile station shall set the TAG_P_REVs-p to TAG_P_REVr.

1 2 3 4 5 6 7 8 9

10 11 12 13 14 15 16 17

18 19 20 21

22 23 24 25 26

3.3.1.4 Re-Authenticate Request Message Processing 4. Re-Authenticate Request Message: The mobile station shall send a ReAuthenticate Response Message within 750 ms after receiving the message. The mobile station shall set RANDs = RANDr. The mobile station shall perform the reauthentication procedures specified in 3.3.2. 3.3.1.5 MS Key Request Message Processing 5. MS Key Request Message: The mobile station shall send a MS Key Response Message within 30 seconds after receiving the message. If the value of A_KEY_P_REV in the MS Key Request Message is not supported by the mobile station, the mobile station shall indicate the error condition by setting RESULT_CODE to 00000011, Rejected - Protocol version mismatch. In this case, the mobile station shall send an MS Key Response Message within 750 ms of receiving the MS Key Request Message. The mobile station shall set PARAM_Ps = PARAM_Pr and PARAM_Gs = PARAM_Gr if A_KEY_P_REV received in the MS Key Request Message = 00000010. If A_KEY_P_REV received in the MS Key Request Message = 00000011, 00000100, or 00000111, the mobile station shall set PARAM_Ps and PARAM_Gs to the values as specified in 5.3.1, respectively.

27 28 29 30 31 32 33 34 35 36 37 38 39

3-11

3GPP2 C.S0016-D v2.0 If A_KEY_P_REV received in the MS Key Request Message = 00000101 or 00001000, the mobile station shall set PARAM_Ps to the value specified in 5.3.1 and PARAM_Gs to the value specified in 5.5.1, respectively.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

If the value of A_KEY_P_REV in the MS Key Request Message is not supported by the mobile station, the mobile station shall indicate the error condition by setting RESULT_CODE to 00000011, Rejected - Protocol version mismatch. The mobile station shall send an MS Key Response Message within 750 ms after receiving this message. If the value of A_KEY_P_REV in the MS Key Request Message is supported by the mobile station, the mobile station shall set RESULT_CODE to 00000000, Accepted - Operation successful. The mobile station shall compute the MS_RESULT value according to the value of A_KEY_P_REV received in the MS Key Request Message as follows: 00000010, calculate MS_RESULT in accordance with 5.1.2; 00000011, calculate MS_RESULT in accordance with 5.3.2; 00000100, calculate MS_RESULT in accordance with 5.3.2; 00000101, calculate MS_RESULT in accordance with 5.5.2; 00000111, calculate MS_RESULT in accordance with 5.7.2; 00001000, calculate MS_RESULT in accordance with 5.9.2. The mobile station shall send an MS Key Response Message within 30 seconds after receiving this message.If A_KEY_P_REV is one of the values in column 1 of the following table and is supported by the mobile station, the mobile station shall set PARAM_Ps to the corresponding value in column 2 of the table and shall set PARAM_Gs to the corresponding value in column 3 of the table, and shall attempt to calculate MS_RESULT in accordance with the corresponding section in column 4 of the following table. A_KEY_P_REV 00000010 00000011 00000100 00000101 00000111 00001000 PARAM_PS PARAM_Pr As specified in section 5.3.1 PARAM_GS PARAM_Gr As specified in section 5.3.1 As specified in section 5.5.1 As specified in section 5.3.1 As specified in section 5.5.1 MS_RESULT 5.1.2 5.3.2

5.5.2 5.7.2 5.9.2

3-12

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10 11

If the mobile station was able to compute the MS_RESULT value it shall set RESULT_CODE to 000000000 Accepted Operation successful.

If the mobile station is unable to compute the MS_RESULT value in accordance with 5.1.2, 5.3.2, 5.5.2, 5.7.2 or 5.9.2, the mobile station shall set RESULT_CODE to 00000001, Rejected - Unknown reason. The mobile station shall send an MS Key Response Message with the specified RESULT_CODE. The mobile station shall send an MS Key Response Message within 30 seconds after receiving this message. 3.3.1.6 Key Generation Request Message Processing The mobile stations shall send a Key Generation Response Message within 30 seconds after receiving this message. Upon receipt of a Key Generation Request Message the MS shall: 6. Key Generation Request Message: If the mobile station has not previously received a MS Key Request Message, has responded to the most recent MS Key Request Message with a RESULT_CODE other than 000000000, or has already received a Key Generation Request Message after the most recent MS Key Request Message that was received, thenIf the mobile station has not received an MS Key Request Message, the mobile station shall indicate anthe error condition by setting RESULT_CODE to 00000110, Rejected - Message not expected in this mode. The mobile station shall send a Key Generation Response Message within 750 ms after receiving this message. If the mobile station has received an MS Key Request Message and returned RESULT CODE other then 00000000, Accepted - Operation successful, the mobile station shall indicate the error condition by setting RESULT_CODE to 00000110, Rejected - Message not expected in this mode. The mobile station shall send a Key Generation Response Message within 750 ms after receiving this message.

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39

If the mobile station has received an Key Generation Request Message with the value of BS_RESULT is equal to 0, the mobile station shall set RESULT_CODE to 00000001, Rejected - Unknown reason. The mobile station shall then send a Key Generation Response Message within 750 ms after receiving this message. Otherwise, the mobile station shall compute the value of the A-key, A-key and Root Key combination, Root Key, or eHRPD Root Key if the value of A_KEY_P_REV received in the MS Key Request Message equals to: 00000010, calculate A-key in accordance with 5.1.3;

3-13

3GPP2 C.S0016-D v2.0 00000011, calculate A-key and Root Key in accordance with 5.3.3; 00000100, calculate Root Key in accordance with 5.3.4; 00000101, calculate Root Key in accordance with 5.5.3; 00000111, calculate eHRPD Root Key in accordance with 5.7.3; 00001000, calculate eHRPD Root Key in accordance with 5.9.3. If the mobile station has does not successfully calculated the A-key, A-key and Root Key combination, Root Key, or eHRPD Root Key in accordance with 5.1.3, 5.3.3, 5.3.4, 5.5.3, 5.7.3 and 5.9.3, respectively, the mobile station shall set RESULT_CODE to 00000001, Rejected - Unknown reason. The mobile station shall then send a Key Generation Response Message within 30 seconds after receiving this message. If the mobile station has successfully calculatesd the A-key, A-key and Root Key combination, Root Key, or eHRPD Root Key in accordance with 5.1.3, 5.3.3, 5.3.4, 5.5.3, 5.7.3 and 5.9.3, respectively, the mobile station shall set RESULT_CODE to 00000000, Accepted - Operation successful. The mobile station shall then send a Key Generation Response Message within 30 seconds after receiving this message. 3.3.1.7 Protocol Capability Request Message Processing 7. Protocol Capability Request Message: If the Protocol Capability Request Message contains the OTASP_P_REV field and the mobile station is able to parse it, then the mobile station shall send the Extended Protocol Capability Response Message within 750 ms after receiving the message; otherwise, the mobile station shall send a Protocol Capability Response Message within 750 ms after receiving the message. 3.3.1.8 SSPR Configuration Request Message Processing 8. SSPR Configuration Request Message: The mobile station shall send an SSPR Configuration Response Message within 750 ms after receiving the message. If either SP_LOCK_STATE = 1, or NAM_LOCK_STATE = 1, or both are set to 1, the mobile station shall set RESULT_CODE in the SSPR Configuration Response Message to 00001010, Rejected - Mobile station locked. The mobile station shall include the requested parameter block with the BLOCK_LEN field set to zero. If both SP_LOCK_STATE and NAM_LOCK_STATE are set to 0, then: If the mobile station does not support the requested parameter block, the mobile station shall set RESULT_CODE in the corresponding returned parameter block to 00000111, Rejected - BLOCK_ID value not supported. The mobile station shall include the parameter block with the BLOCK_LEN field set to zero.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

18 19 20 21 22 23

24 25 26 27 28 29 30 31 32 33 34 35 36 37

3-14

3GPP2 C.S0016-D v2.0 If the SSPR Configuration Request Message contains the request for the Preferred Roaming List Dimension Parameter Block (BLOCK_ID = 00000000) and if the mobile station supports SSPR_P_REV greater than or equal to 00000011 and stores preferred roaming list associated with SSPR_P_REV greater than or equal to 00000011, then, the mobile station shall set the RESULT_CODE in the SSPR Configuration Response Message to 00100011, Rejected PRL format mismatch. The mobile station shall include the parameter block with the BLOCK_LEN field set to zero. If the REQUEST_OFFSETr received in the message specifies an offset which is invalid for the current preferred roaming list, the mobile station shall set the RESULT_CODE in the corresponding returned parameter block to 00000010, Rejected - Data size mismatch. The mobile station shall set the BLOCK_ID to the corresponding parameter block identifier, the SEGMENT_OFFSET in the returned Parameter Block to the value of the REQUEST_OFFSETr, the SEGMENT_SIZE to 00000000, and shall include no octets of the preferred roaming list in the returned Parameter Block. Otherwise, if the SSPR Configuration Request Message contains the request for the Preferred Roaming List Parameter Block (BLOCK_ID = 00000001), and if the REQUEST_OFFSETr received in the message is valid for the current preferred roaming list, the mobile station shall set the RESULT_CODE in the SSPR Configuration Response Message to 00000000, Accepted - Operation successful for the Parameter Block included in the message. The mobile station shall include the preferred roaming list data (PR_LISTs-p) starting at the offset corresponding to the REQUEST_OFFSETr and not exceeding a maximum number of octets corresponding to the REQUEST_MAX_SIZEr received in the message. The mobile station shall set the SEGMENT_OFFSET in the returned Parameter Block to the value of the REQUEST_OFFSETr received in the message. The mobile station shall set the SEGMENT_SIZE field to the number of octets of the preferred roaming list included in the returned Parameter Block. If the Parameter Block contains the last segment of the preferred roaming list data, the mobile station shall set the LAST_SEGMENT field to 1; otherwise the mobile station shall set the LAST_SEGMENT field to 0 in the returned Parameter Block. 3.3.1.9 SSPR Download Request Message Processing 9. SSPR Download Request Message: The mobile station shall respond to the message with an SSPR Download Response Message within 750 ms. If FRESH_INCLr = 1 and the SECURE_MODE_INDS = 1, the mobile station shall set FRESHS = FRESHr and decrypt as specified in 3.3.8 each

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

29 30 31 32 33 34 35 36 37

38 39 40 41 42

3-15

3GPP2 C.S0016-D v2.0 PARAM_DATA field of all Parameter Blocks received in the SSPR Download Request Message. If the SSPR Download Request Message contains an SSPR Parameter Block with a BLOCK_ID that is not supported by the mobile station, the mobile station shall set the RESULT_CODE in the SSPR Download Response Message to 00000111, Rejected - BLOCK_ID value not supported and shall set the BLOCK_ID to the received parameter block identifier. o If the BLOCK_ID is 00000000 or 00000001, tThe The mobile station shall set the SEGMENT_OFFSET and the SEGMENT_SIZE in the SSPR Download Response Message to 0x0000 and 0x00, respectively00000000.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

If the SSPR Download Request Message contains an SSPR Parameter Block having a size different from that supported by the mobile station, the mobile station shall set the RESULT_CODE in the SSPR Download Response Message to 00000010, Rejected - Data size mismatch and shall set the BLOCK_ID to the received parameter block identifier. o The mobile station shall set SEGMENT_OFFSET to the value of SEGMENT_OFFSET received in the message. The mobile station shall set SEGMENT_SIZE to the value of SEGMENT_SIZE received in the message.

If the SSPR Download Request Message does not contain an SSPR Parameter Block with a BLOCK_ID of either 00000000 (Preferred Roaming List) or 00000001 (Extended Preferred Roaming List), the mobile station shall omit the SEGMENT_OFFSET and SEGMENT_SIZE. Otherwise, if the BLOCK_ID field in the SSPR Download Request Message is equal to 00000000 or 00000001 (Preferred Roaming List Parameter Block or Extended Preferred Roaming List Parameter Block, respectively), the mobile station shall perform the following: - The mobile station shall set SEGMENT_OFFSET to the value of SEGMENT_OFFSET received in the message. The mobile station shall set SEGMENT_SIZE to the value of SEGMENT_SIZE received in the message. If PRL_BLOCK_ID_CURRENTs is not NULLPRL_BLOCK_ID and the value of the BLOCK_IDr field is not equal to PRL_BLOCK_ID_CURRENTs, the mobile station shall perform the following: + + Set the RESULT_CODE in the SSPR Download Response Message to 00100010, Rejected Unexpected PRL BLOCK_ID change. In the SSPR Download Response Message, set the BLOCK_ID to the received parameter block identifier and set the SEGMENT_OFFSET and the SEGMENT_SIZE to 00000000. Discard all the SEGMENT_DATA octets that have been received in an SSPR Download Request Message with the BLOCK_ID field set to 00000000 or 00000001. Set the PRL_BLOCK_ID_CURRENTs to NULLPRL_BLOCK_ID.

3-16

3GPP2 C.S0016-D v2.0 Otherwise, the mobile station shall perform the following: + + Set the PRL_BLOCK_ID_CURRENTs to the value of the BLOCK_ID field received in the SSPR Download Request Message. If SEGMENT_OFFSET andin conjunction with SEGMENT_SIZE are inconsistent with the preferred roaming list storage capabilities of the mobile station, the mobile station shall set the RESULT_CODE to 00001000, Rejected - Preferred roaming list length mismatch and shall set the BLOCK_ID to the received parameter block identifier. Otherwise, if SEGMENT_OFFSET andin conjunction with SEGMENT_SIZE are consistent with the preferred roaming list storage capabilities of the mobile station, the mobile station shall store the SEGMENT_DATA octets in temporary memory. o If LAST_SEGMENT is equal to 0, the mobile station shall set the RESULT_CODE to 00000000, Accepted - Operation successful and shall set the BLOCK_ID to the received parameter block identifier. If LAST_SEGMENT is equal to 1, the mobile station shall calculate the CRC, as specified in Section 3.5.5.1 for the preferred roaming list stored in temporary memory. If the CRC checks, the mobile station shall set the RESULT_CODE to 00000000, Accepted - Operation successful; otherwise, the mobile station shall set the RESULT_CODE to 00001001, Rejected - CRC error and shall discard this segment and all previously assembled segments of the preferred roaming list from the temporary memory. The mobile station shall set the BLOCK_ID to the received parameter block identifier.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

3.3.1.10 Validation Request Message Processing 10. Validation Request Message: The mobile station shall send a Validation Response Message within 750 ms after receiving the message. If the Validation Request Message contains a Validation Parameter Block with a BLOCK_ID that is not supported by the mobile station, the mobile station shall set the BLOCK_ID to the received parameter block identifier and shall set the RESULT_CODE to 00000111, Rejected - BLOCK_ID value not supported; If the Validation Request Message contains a Validation Parameter Block having a size different from that supported by the mobile station, the mobile station shall set the RESULT_CODE to 00000010, Rejected - Data size mismatch and shall set the BLOCK_ID to the received parameter block identifier. If the Validation Request Message contains a Validation Parameter Block with a parameter value that is out-of-range, the mobile station shall set the RESULT_CODE to 00000100, Rejected - Invalid parameter and the BLOCK_ID to the received parameter block identifier.

3-17

3GPP2 C.S0016-D v2.0 If the Validation Request Message is not accepted for any other reason, the mobile station shall set the RESULT_CODE to 00000001, Rejected - Unknown reason and shall set the BLOCK_ID to the received parameter block identifier. If the Validation Request Message contains the Verify SPC Parameter Block, the mobile station shall compare the SPCr received in the message with the SPCs. If the comparison results in a mismatch, the mobile station shall set the RESULT_CODE to 00001011, Rejected - Invalid SPC and shall set the BLOCK_ID to the received parameter block identifier. Otherwise, if the comparison results in a match, the mobile station shall set the RESULT_CODE to 00000000, Accepted - Operation successful and shall set the BLOCK_ID to the received parameter block identifier. The mobile station shall set the SP_LOCK_STATE to 0.

1 2 3 4 5

6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

If the Validation Request Message contains the Change SPC Parameter Block, the mobile station shall do the following: If SP_LOCK_STATE = 1, the mobile station shall set the RESULT_CODE to 00001010, Rejected - Mobile station locked and shall set the BLOCK_ID to the received parameter block identifier. If SP_LOCK_STATE = 0 and SPCs is set to the default value, the mobile station shall do the following: + If the mobile station is programmed by the user to accept SPC change (see 3.3.6), the mobile station shall set the RESULT_CODE to 00000000, Accepted - Operation successful and shall set the BLOCK_ID to the received parameter block identifier. The mobile station shall set SPCs to SPCr received in the message. If the mobile station is programmed by the user to deny SPC change, the mobile station shall set the RESULT_CODE to 00001100, Rejected SPC change denied by the user and shall set the BLOCK_ID to the received parameter block identifier.

25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

Otherwise, if SP_LOCK_STATE = 0 and if the SPCs is not set to the default value, the mobile station shall set SPCs = SPCr received in the message and shall set the RESULT_CODE to 00000000, Accepted - Operation successful and the BLOCK_ID to the received parameter block identifier.

If the Validation Request Message contains both the Verify SPC Parameter Block and the Change SPC Parameter Block, the mobile station shall process the Verify SPC Parameter Block first. If the Validation Request Message contains the Validate SPASM Parameter Block, the mobile station shall do the following: If the programming session was initiated by the user as described in 3.2.1, the mobile station shall set the RESULT_CODE to 00001110, Rejected BLOCK_ID not expected in this mode and shall set the BLOCK_ID to the received parameter block identifier.

3-18

3GPP2 C.S0016-D v2.0 If the NAM_LOCK_STATE = 0, the mobile station shall set the RESULT_CODE to 00000000, Accepted - Operation successful and shall set the BLOCK_ID to the received parameter block identifier. The mobile station shall set NAM_LOCKs = NAM_LOCKr received in the message. If the NAM_LOCK_STATE = 1, the mobile station shall compare the AUTH_OTAPAr received in the message with the AUTH_OTAPAs calculated using SPASM Validation Procedure defined in 3.3.7. + If the comparison results in a mismatch, the mobile station shall set the RESULT_CODE to 00001101, Rejected - Invalid SPASM and shall set the BLOCK_ID to the received parameter block identifier. If the comparison results in a match, the mobile station shall set the RESULT_CODE to 00000000, Accepted - Operation successful and shall set the BLOCK_ID to the received parameter block identifier. The mobile station shall set the NAM_LOCK_STATE to 0 and the NAM_LOCKs = NAM_LOCKr.

1 2 3 4

5 6 7 8 9 10 11 12 13 14 15

16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35

3.3.1.11 OTAPA Request Message Processing 11. OTAPA Request Message: The mobile station shall send the OTAPA Response Message within 750 ms after receiving the message. If the programming session was initiated by the user as described in 3.2.1, the mobile station shall indicate the error condition by setting RESULT_CODE to 00000110, Rejected - Message not expected in this mode. The mobile station shall set the NAM_LOCK_IND field to 0 and shall omit the RAND_OTAPA field in the OTAPA Response Message. If the mobile station does not support OTAPA, or if the OTAPA was disabled by the user as described in 3.2.2, the mobile station shall indicate the error condition by setting RESULT_CODE to 00000110, Rejected - Message not expected in this mode. The mobile station shall set the NAM_LOCK_IND field to 0 and shall omit the RAND_OTAPA field in the OTAPA Response Message. If the START_STOPr field received in the message is equal to 1, the mobile station shall do the following: If the NAM_LOCK_STATE = 1, the mobile station shall set the NAM_LOCK_IND field to 1, RAND_OTAPA field to a randomly generated 32bit value, and shall set the RESULT_CODE to the 00000000, Accepted Operation successful in the OTAPA Response Message. The mobile station shall generate the AUTH_OTAPAs as specified in 3.3.7. If the NAM_LOCK_STATE = 0, the mobile station shall set the NAM_LOCK_IND field to 0, the RESULT_CODE to the 00000000, Accepted - Operation successful, and shall omit the RAND_OTAPA field in the OTAPA Response Message. The mobile station shall start the OTAPA session (see 3.2.2.3).

36 37 38 39 40

3-19

3GPP2 C.S0016-D v2.0 If the START_STOPr field received in the message is equal to 0, the mobile station shall set the NAM_LOCK_IND field to 0, the RESULT_CODE to the 00000000, Accepted - Operation successful, and shall omit the RAND_OTAPA field in the OTAPA Response Message. The mobile station shall terminate the OTAPA session (see 3.4). 3.3.1.12 PUZL Configuration Request Message Processing 12. PUZL Configuration Request Message: The mobile station shall send a PUZL Configuration Response Message within 750 ms after receiving the message. If either SP_LOCK_STATE = 1, or NAM_LOCK_STATE = 1, or both are set to 1, the mobile station shall set RESULT_CODE in the PUZL Configuration Response Message to 00001010, Rejected - Mobile station locked. The mobile station shall set BLOCK_ID to the received value and set BLOCK_LEN to zero. If both SP_LOCK_STATE and NAM_LOCK_STATE are set to 0, then: If the mobile station does not support the requested parameter block, the mobile station shall set RESULT_CODE in the PUZL Configuration Response Message to 00000111, Rejected - BLOCK_ID value not supported. The mobile station shall set BLOCK_ID to the received value and set BLOCK_LEN to zero. If the PUZL Configuration Request Message contains the request for the PUZL Priorities Parameter Block (BLOCK_ID = 00000001), and the REQUEST_INDEX value received in the message specifies an index that is invalid for the current preferred user zone list, the mobile station shall set RESULT_CODE in the PUZL Configuration Response Message to 00000010, Rejected Data size mismatch. The mobile station shall set BLOCK_ID to the received parameter block identifier, set SEGMENT_INDEX in the returned parameter block to the value of the REQUEST_INDEX, set NUM_ENTRIES to 00000000 and include no UZ_ID, UZ_SID and UZ_PRIORITY field data. Otherwise, if the PUZL Configuration Request Message contains the request for the PUZL Priorities Parameter Block (BLOCK_ID = 00000001), and the REQUEST_INDEX value received in the message specifies an index which is valid for the current preferred user zone list, the mobile station shall set RESULT_CODE in the PUZL Configuration Response Message to 00000000, Accepted Operation successful and shall set BLOCK_ID to the received parameter block identifier. The mobile station shall include the UZ_ID, UZ_SID and UZ_PRIORITY values starting at the user zone entry in the current preferred user zone list corresponding to the REQUEST_INDEX value and not exceeding the maximum number of user zone entries specified by the REQUEST_MAX_ENTRIES value received in the message.

1 2 3 4 5

6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

3-20

3GPP2 C.S0016-D v2.0 The mobile station shall set SEGMENT_INDEX in the returned parameter block to the value of the REQUEST_INDEX received in the message. The mobile station shall set the NUM_ENTRIES field to the number of user zone entries for which ID, SID and priority information has been included in the returned parameter block. If the parameter block contains the information for the last user zone entry of the current preferred user zone list, the mobile station shall set the LAST_SEGMENT field to 1; otherwise, the mobile station shall set the LAST_SEGMENT field to 0 in the returned parameter block. If the PUZL Configuration Request Message contains the request for the User Zone Parameter Block (BLOCK_ID = 00000010), and if the user zone entry identified by the UZ_ID and UZ_SID values received in the message is not present in the current preferred user zone list, the mobile station shall set RESULT_CODE in the PUZL Configuration Response Message to 00010000, Rejected User Zone not in PUZL. The mobile station shall set BLOCK_ID to the received value and set BLOCK_LEN to zero. If the PUZL Configuration Request Message contains the request for the User Zone Parameter Block (BLOCK_ID = 00000010), and if the REQUEST_OFFSET value received in the message specifies an offset which is invalid for the user zone entry, the mobile station shall set RESULT_CODE in the PUZL Configuration Response Message to 00000010, Rejected Data size mismatch. The mobile station shall set BLOCK_ID to the received parameter block identifier, set SEGMENT_OFFSET in the returned parameter block to the value of the REQUEST_OFFSET, set UZ_ID and UZ_SID to the values received in the message, set SEGMENT_SIZE to 00000000 and include no octets of the user zone entry in the returned parameter block. Otherwise, if the PUZL Configuration Request Message contains the request for the User Zone Parameter Block (BLOCK_ID = 00000010), and if the REQUEST_OFFSET value received in the message specifies an offset which is valid for the specified user zone entry, the mobile station shall set RESULT_CODE in the PUZL Configuration Response Message to 00000000, Accepted Operation successful, and shall set BLOCK_ID to the received parameter block identifier. The mobile station shall include the user zone entry of the preferred user zone list starting at the offset corresponding to the REQUEST_OFFSET and not exceeding a maximum number of octets corresponding to the REQUEST_MAX_SIZE received in the message. The mobile station shall set SEGMENT_OFFSET in the returned parameter block to the value of the REQUEST_OFFSET received in the message and set UZ_ID and UZ_SID to the values received in the message.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

3-21

3GPP2 C.S0016-D v2.0 The mobile station shall set SEGMENT_SIZE to the number of octets of the user zone entry included in the returned parameter block. If the parameter block contains the last segment of the user zone entry, the mobile station shall set the LAST_SEGMENT field to 1; otherwise, the mobile station shall set the LAST_SEGMENT field to 0 in the returned parameter block. If the PUZL Configuration Request Message contains the request for the Preferred User Zone List Parameter Block (BLOCK_ID = 00000011), and if the REQUEST_INDEX value received in the message specifies an index which is invalid for the current preferred user zone list, the mobile station shall set RESULT_CODE in the PUZL Configuration Response Message to 00000010, Rejected Data size mismatch. The mobile station shall set BLOCK_ID to the received parameter block identifier, set NUM_ENTRIES to 1 in the returned parameter block, set SEGMENT_INDEX to the value of the REQUEST_INDEX, set SEGMENT_OFFSET to the value of REQUEST_OFFSET, set SEGMENT_SIZE to 00000000 and include no octets of the preferred user zone list in the returned parameter block. If the PUZL Configuration Request Message contains the request for the Preferred User Zone List Parameter Block (BLOCK_ID = 00000011), and if the REQUEST_OFFSET value received in the message specifies an offset which is invalid for user zone entry identified by REQUEST_INDEX of the current preferred user zone list, the mobile station shall set RESULT_CODE in the PUZL Configuration Response Message to 00000010, Rejected Data size mismatch. The mobile station shall set BLOCK_ID to the received parameter block identifier, set NUM_ENTRIES to 1 in the returned parameter block, set SEGMENT_INDEX to the value of the REQUEST_INDEX, set SEGMENT_OFFSET to the value of REQUEST_OFFSET, set SEGMENT_SIZE to 00000000 and include no octets of the preferred user zone list in the returned parameter block. Otherwise, if the PUZL Configuration Request Message contains the request for the Preferred User Zone List Parameter Block (BLOCK_ID = 00000011), and if the REQUEST_INDEX value received in the message specifies an index which is valid for the current preferred user zone list, and if the REQUEST_OFFSET value received in the message specifies an offset which is valid for the user zone entry identified by REQUEST_INDEX, the mobile station shall set RESULT_CODE to 00000000, Accepted Operation successful, and shall set BLOCK_ID to the received parameter block identifier. The mobile station shall include the user zone entry specified by REQUEST_INDEX of the preferred user zone list starting at the offset corresponding to REQUEST_OFFSET and not exceeding a maximum number of octets corresponding to REQUEST_MAX_SIZE received in the message.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43

3-22

3GPP2 C.S0016-D v2.0 The mobile station shall set SEGMENT_INDEX in the returned parameter block to the value of REQUEST_INDEX received in the message and shall set SEGMENT_OFFSET to the value of REQUEST_OFFSET. The mobile station shall set SEGMENT_SIZE to the number of octets of the user zone entry included in the returned parameter block. If the parameter block contains the last segment of the user zone entry, the mobile station shall set the LAST_SEGMENT field to 1; otherwise, the mobile station shall set the LAST_SEGMENT field to 0 in the returned parameter block. If the last segment of a user zone entry is included in the returned parameter block and if the REQUEST_MAX_SIZE number of octets has not been included, the mobile station shall include a segment of the next user zone entry of the preferred user zone list. When including the start of a subsequent user zone entry, the mobile shall set the SEGMENT_OFFSET to 00000000 and shall not include a segment of less than four octets. The SEGMENT_INDEX shall be set appropriately and the LAST_SEGMENT and SEGMENT_SIZE shall be set as described above. The mobile station shall set NUM_ENTRIES to the number of user zone entry segments included in the returned parameter block. If the PUZL Configuration Request Message contains the request for a valid parameter block and if there is no entry in the current preferred user zone list, the mobile station shall set the RESULT_CODE in the PUZL Configuration Response Message to 00010001, Rejected No entries in PUZL, and shall set the BLOCK_ID to the received parameter block identifier Otherwise, if SECURE_MODE_INDS = 1, the mobile station shall set the FRESH_INCL field to 1, and include the FRESH field set to a 15-bit value selected according to 3.3.8. The mobile station shall encrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks included in the PUZL Configuration Response Message. PUZL Download Request Message Processing

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

30 31 32 33 34 35 36 37 38 39 40 41

3.3.1.13

13. PUZL Download Request Message : The mobile station shall send a PUZL Download Response Message within 750 ms after receiving the message. If FRESH_INCLr = 1 and the SECURE_MODE_INDS = 1, the mobile station shall set FRESHS = FRESHr and decrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks received in the PUZL Download Request Message. If the PUZL Download Request Message contains a PUZL Parameter Block with a BLOCK_ID that is not supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier, set RESULT_CODE to 00000111, Rejected - BLOCK_ID value not supported, and set IDS_PRESENT to 0. The UZ_ID and UZ_SID fields shall not be included in the returned parameter block.

3-23

3GPP2 C.S0016-D v2.0 If the PUZL Download Request Message contains a PUZL Parameter Block having a size different from that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier, set RESULT_CODE to 00000010, Rejected - Data size mismatch, and set IDS_PRESENT to 0. The UZ_ID and UZ_SID fields shall not be included in the returned parameter block. If the PUZL Download Request Message contains a PUZL Parameter Block with a parameter value that is out-of-range, the mobile station shall set BLOCK_ID to the received parameter block identifier, set RESULT_CODE to 00000100, Rejected - Invalid parameter and shall set IDS_PRESENT to 0. The UZ_ID and UZ_SID fields shall not be included in the returned parameter block. If the PUZL Download Request Message is not accepted for any other reason, the mobile station shall set BLOCK_ID to the received parameter block identifier, set RESULT_CODE to 00000001, Rejected - Unknown reason, and set IDS_PRESENT to 0. The UZ_ID and UZ_SID fields shall not be included in the returned parameter block. If the PUZL Download Request Message contains the User Zone Insert Parameter Block and the User Zone ID/System ID pair already exists in the current preferred user zone list, the mobile station shall set BLOCK_ID to the received parameter block identifier, set RESULT_CODE to 00001111, Rejected User Zone already in PUZL, and set IDS_PRESENT to 1. The mobile station shall include the UZ_ID and UZ_SID fields in the returned parameter block containing the values received. Otherwise, the mobile station shall store the parameter block data in temporary memory, set BLOCK_ID to the received parameter block identifier, set RESULT_CODE to 00000000, Accepted - Operation successful, and set IDS_PRESENT to 1. The mobile station shall include the UZ_ID and UZ_SID fields in the returned parameter block containing the values received. If more than one PUZL Download Request Message or parameter block is received containing the same user zone entry segment, the mobile station shall retain only the most recently received data.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38

If the PUZL Download Request Message contains the User Zone Update Parameter Block and the User Zone ID/System ID pair does not exist in the current preferred user zone list, the mobile station shall set BLOCK_ID to the received parameter block identifier, set RESULT_CODE to 00010000, Rejected User Zone not in PUZL, and set IDS_PRESENT to 1. The mobile station shall include the UZ_ID and UZ_SID fields in the returned parameter block containing the values received.

3-24

3GPP2 C.S0016-D v2.0 Otherwise, the mobile station shall store the parameter block data in temporary memory, set BLOCK_ID to the received parameter block identifier, set RESULT_CODE to 00000000, Accepted - Operation successful, and set IDS_PRESENT to 1. The mobile station shall include the UZ_ID and UZ_SID fields in the returned parameter block containing the values received. If more than one PUZL Download Request Message or parameter block is received containing the same user zone entry segment, the mobile station shall retain only the most recently received data.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44

If the PUZL Download Request Message contains the User Zone Delete Parameter Block, and if the User Zone ID/System ID pair does not exist in the current preferred user zone list, the mobile station shall set BLOCK_ID to the received parameter block identifier, set RESULT_CODE to 00010000, Rejected User Zone not in PUZL, and shall set IDS_PRESENT to 1. The mobile station shall include the UZ_ID and UZ_SID fields in the returned parameter block containing the values received. Otherwise, the mobile station shall mark the specified user zone entry to be deleted, set BLOCK_ID to the received parameter block identifier, set RESULT_CODE to 00000000, Accepted - Operation successful, and set IDS_PRESENT to 1. The mobile station shall include the UZ_ID and UZ_SID fields in the returned parameter block containing the values received.

If the PUZL Download Request Message contains the User Zone Priority Change Parameter Block and the User Zone ID/System ID pair does not exist in the current preferred user zone list, the mobile station shall set BLOCK_ID to the received parameter block identifier, set RESULT_CODE to 00010000, Rejected User Zone not in PUZL, and set IDS_PRESENT to 1. The mobile station shall include the UZ_ID and UZ_SID fields in the returned parameter block containing the values received. Otherwise, the mobile station shall store the parameter block data in temporary memory, set BLOCK_ID to the received parameter block identifier, set RESULT_CODE to 00000000, Accepted - Operation successful, and set IDS_PRESENT to 1. The mobile station shall include the UZ_ID and UZ_SID fields in the returned parameter block containing the values received. If more than one PUZL Download Request Message or parameter block is received for the same user zone, the mobile station shall retain only the most recently received data.

If the PUZL Download Request Message contains the PUZL Flags Parameter Block, the mobile station shall store the parameter block data in temporary memory, set BLOCK_ID to the received parameter block identifier, set RESULT_CODE to 00000000, Accepted - Operation successful, and set IDS_PRESENT to 0. The UZ_ID and UZ_SID fields shall not be included in the returned parameter block. If more than one PUZL Download Request Message or parameter block is received, the mobile station shall retain only the most recently received data.

3-25

3GPP2 C.S0016-D v2.0 3.3.1.14 3GPD Configuration Request Message Processing 14. 3GPD Configuration Request Message : The mobile station shall send a 3GPD Configuration Response Message within 750 ms after receiving the message. If Secure Mode is not active and the 3GPD Configuration Request Message contains a SimpleIPSimple IP PAP Parameter Block, SimpleIPSimple IP CHAP SS Parameter Block, MobileIPMobile IP SS Parameter Block, HRPD Access Authentication CHAP SS Paramater Block or eHRPD MILENAGE Algorithm Parameter Block, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00110011, Rejected Secure Mode not active. If either SP_LOCK_STATE = 1, or NAM_LOCK_STATE = 1, or both are set to 1, the mobile station shall set the RESULT_CODE in the corresponding returned confirmation blocks to 00001010, Rejected - Mobile station locked. The mobile station shall include all requested parameter blocks with the BLOCK_LEN field set to 00000000. If both SP_LOCK_STATE and NAM_LOCK_STATE are set to 0, then: If the mobile station does not support a requested parameter block, the mobile station shall set RESULT_CODE in the corresponding returned confirmation block to 00000111, Rejected - BLOCK_ID value not supported. The mobile station shall include the parameter block with the BLOCK_LEN field set to 00000000. If the requested data blocks exceed the allowable message length, the mobile station shall set RESULT_CODE in the corresponding returned confirmation block to 00000000, Accepted - Operation successful for each Parameter Block included in the message. The mobile station shall include data blocks, in the order requested, up to the maximum number of blocks that fit into the message. If SECURE_MODE_INDS = 1, the mobile station shall set the FRESH_INCL field to 1, include the FRESH field and set it to a 15-bit value selected according to 3.3.8. The mobile station shall encrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks included in the 3GPD Configuration Response Message. All the encrypted Parameter Blocks and FRESH field shall fit into the 3GPD Configuration Response Message. Otherwise, the mobile station shall set RESULT_CODE to 00000000, Accepted - Operation successful for each Parameter Block included in the corresponding confirmation block. The mobile station shall include complete data blocks, in the order requested, in the 3GPD Configuration Response Message. . If SECURE_MODE_INDS = 1, the mobile station shall set the FRESH_INCL field to 1, and include the FRESH field and set it to a 15-bit value selected according to 3.3.8. The mobile station shall encrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks included in the 3GPD Configuration Response Message.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

3-26

3GPP2 C.S0016-D v2.0 3.3.1.15 3GPD Download Request Message Processing 15. 3GPD Download Request Message : The mobile station shall respond to the message with a 3GPD Download Response Message within 750 ms. If Secure Mode is not active and the 3GPD Download Request Message contains a SimpleIPSimple IP PAP Parameter Block, SimpleIPSimple IP CHAP SS Parameter Block, MobileIPMobile IP SS Parameter Block, HRPD Access Authentication CHAP SS Paramater Block or eHRPD MILENAGE Algorithm Parameter Block, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00110011, Rejected Secure Mode not active. If FRESH_INCLr = 1, the mobile station shall set FRESHS = FRESHr. If the SECURE_MODE_INDS = 1, the mobile station shall decrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks received in the 3GPD Download Request Message. If the 3GPD Download Request Message contains an 3GPD Parameter Block with a BLOCK_ID that is not supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000111, Rejected - BLOCK_ID value not supported; If the 3GPD Download Request Message contains an 3GPD Parameter Block having a size different from that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000010, Rejected - Data size mismatch; If the 3GPD Download Request Message contains an 3GPD Parameter Block with a parameter value that is out-of-range, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000100, Rejected - Invalid parameter; If the 3GPD Download Request Message contains an Operation Mode Parameter Block with a OP_MODE not supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00010010, Rejected Operation Mode mismatch; If the 3GPD Download Request Message contains a SimpleIPSimple IP User Profile Parameter Block with a NUM_NAI or any NAI_ENTRY_INDEX greater than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00010011, Rejected SimpleIPSimple IP MAX_NUM_NAI mismatch; If the 3GPD Download Request Message contains a SimpleIPSimple IP User Profile Parameter Block with any NAI_LENGTH larger than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00010100, Rejected SimpleIPSimple IP MAX_NAI_LENGTH mismatch;

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

3-27

3GPP2 C.S0016-D v2.0 If the 3GPD Download Request Message contains a MobileIPMobile IP User Profile Parameter Block with a NUM_NAI or any NAI_ENTRY_INDEX greater than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00010101, Rejected MobileIPMobile IP MAX_NUM_NAI mismatch; If the 3GPD Download Request Message contains a MobileIPMobile IP User Profile Parameter Block with any NAI_LENGTH larger than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00010110, Rejected MobileIPMobile IP MAX_NAI_LENGTH mismatch; If the 3GPD Download Request Message contains a SimpleIPSimple IP PAP SS Parameter Block with a SS_LENGTH larger than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00010111, Rejected SimpleIPSimple IP PAP MAX_SS_LENGTH mismatch; If the 3GPD Download Request Message contains a SimpleIPSimple IP CHAP SS Parameter Block with a SS_LENGTH larger than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00011000, Rejected SimpleIPSimple IP CHAP MAX_SS_LENGTH mismatch; If the 3GPD Download Request Message contains a MobileIPMobile IP SS Parameter Block with a MN-AAA_SS_LENGTH larger than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00011001, Rejected MAX_MNAAA_SS_LENGTH mismatch; If the 3GPD Download Request Message contains a MobileIPMobile IP SS Parameter Block with a MN-HA_SS_LENGTH larger than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00011010, Rejected MAX_MNHA_SS_LENGTH mismatch; If the 3GPD Download Request Message contains a MobileIPMobile IP User Profile Parameter Block with any MN-AAA_AUTH_ALGORITHM not supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00011011, Rejected MNAAA_AUTH_ALGORITHM mismatch; If the 3GPD Download Request Message contains a MobileIPMobile IP User Profile Parameter Block with any MN-HA_AUTH_ ALGORITHM not supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00011100, Rejected MNHA_AUTH_ ALGORITHM mismatch;

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

3-28

3GPP2 C.S0016-D v2.0 If the 3GPD Download Request Message contains a SimpleIPSimple IP Status Parameter Block with an ACT_NAI_ENTRY_INDEX not supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00011101, Rejected SimpleIPSimple IP ACT_NAI_ENTRY_INDEX mismatch; If the 3GPD Download Request Message contains a MobileIPMobile IP Status Parameter Block with an ACT_NAI_ENTRY_INDEX not supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00011110, Rejected MobileIPMobile IP ACT_NAI_ENTRY_INDEX mismatch; If the 3GPD Download Request Message contains a SimpleIPSimple IP PAP SS Parameter Block with an NAI_ENTRY_INDEX not supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00011111, Rejected SimpleIPSimple IP PAP NAI_ENTRY_INDEX mismatch; If the 3GPD Download Request Message contains a SimpleIPSimple IP CHAP SS Parameter Block with an NAI_ENTRY_INDEX not supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00100000, Rejected SimpleIPSimple IP CHAP NAI_ENTRY_INDEX mismatch; If the 3GPD Download Request Message contains a MobileIPMobile IP SS Parameter Block with an NAI_ENTRY_INDEX not supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00100001, Rejected MobileIPMobile IP NAI_ENTRY_INDEX mismatch;

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38

If the 3GPD Download Request Message contains a HRPD Access Authentication User Profile Parameter Block with any NAI_LENGTH larger than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00100100, Rejected HRPD Access Authentication MAX_NAI_LENGTH mismatch; If the 3GPD Download Request Message contains a HRPD Access Authentication CHAP SS Parameter Block with a SS_LENGTH larger than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00100101, Rejected HRPD Access Authentication CHAP_MAX_SS_LENGTH mismatch;

If the 3GPD Download Request Message is not accepted for any other reason, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000001, Rejected Unknown reason;

3-29

3GPP2 C.S0016-D v2.0 Otherwise, the mobile station shall store the message data in temporary memory, set BLOCK_ID to the received parameter block identifier and set RESULT_CODE to 00000000, Accepted Operation successful. If more than one 3GPD Download Request Message or parameter block is received containing values for the same indicators, the mobile station shall retain only the most recently received values. Secure Mode Request Message Processing

1 2 3 4 5

6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

3.3.1.16

16. Secure Mode Request Message: The mobile station shall send the Secure Mode Response Message within 750 ms after receiving the message. If either SP_LOCK_STATE = 1, or NAM_LOCK_STATE = 1, or both are set to 1, the mobile station shall indicate the error condition by setting the RESULT_CODE to 00001010, Rejected - Mobile station locked in the Secure Mode Response Message. If both SP_LOCK_STATE and NAM_LOCK_STATE are set to 0, then: If the START_STOPr field received in the message is equal to 1, the mobile station shall do the following: + + + The mobile station shall set SECURE_MODE_INDS = 1. The mobile station shall generate SMCKs (see 3.3.8.23.8.2). The mobile station shall set the RESULT_CODE to 00000000, Accepted - Operation successful, in the Secure Mode Response Message.

If the START_STOPr field received in the message is equal to 0, the mobile station shall set the RESULT_CODE to the 00000000, Accepted Operation successful, in the Secure Mode Response Message. If the Secure Mode is active, the mobile station shall terminate the Secure Mode. The mobile station shall set SECURE_MODE_INDS = 0 and SMCKs to NULLSMCK.

25 26 27 28 29 30 31 32 33 34 35 36 37 38

3.3.1.17 MMD Configuration Request Message Processing 17. MMD Configuration Request Message : The mobile station shall send a MMD Configuration Response Message within 750 ms after receiving the message. If either SP_LOCK_STATE = 1, or NAM_LOCK_STATE = 1, or both are set to 1, the mobile station shall set the RESULT_CODE in the corresponding returned confirmation blocks to 00001010, Rejected - Mobile station locked. The mobile station shall include all requested parameter blocks with the BLOCK_LEN field set to 00000000. If both SP_LOCK_STATE and NAM_LOCK_STATE are set to 0, then: If the mobile station does not support a requested parameter block, the mobile station shall set RESULT_CODE in the corresponding returned confirmation block to 00000111, Rejected - BLOCK_ID value not supported. The mobile station shall include the parameter block with the BLOCK_LEN field set to 00000000.

3-30

3GPP2 C.S0016-D v2.0 If the requested data blocks exceed the allowable message length, the mobile station shall set RESULT_CODE in the corresponding returned confirmation block to 00000000, Accepted - Operation successful for each Parameter Block included in the message. The mobile station shall include data blocks, in the order requested, up to the maximum number of blocks that fit into the message. If SECURE_MODE_INDS = 1, the mobile station shall set the FRESH_INCL field to 1, include the FRESH field and set it to a 15-bit value selected according to 3.3.8. The mobile station shall encrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks included in the MMD Configuration Response Message. All the encrypted Parameter Blocks and FRESH field shall fit into the MMD Configuration Response Message. Otherwise, the mobile station shall set RESULT_CODE to 00000000, Accepted - Operation successful for each Parameter Block included in the corresponding confirmation block. The mobile station shall include complete data blocks, in the order requested, in the MMD Configuration Response Message. . If SECURE_MODE_INDS = 1, the mobile station shall set the FRESH_INCL field to 1, and include the FRESH field and set it to a 15-bit value selected according to 3.3.8. The mobile station shall encrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks included in the MMD Configuration Response Message.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

3.3.1.18 MMD Download Request Message Processing 18. MMD Download Request Message: The mobile station shall respond to the message with a MMD Download Response Message within 750 ms. If FRESH_INCLr = 1, the mobile station shall set FRESHS = FRESHr. If the SECURE_MODE_INDS = 1, the mobile station shall decrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks received in the MMD Download Request Message. If the MMD Download Request Message contains an MMD Application Parameter Block with a BLOCK_ID that is not supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000111, Rejected - BLOCK_ID value not supported; If the MMD Download Request Message contains an MMD Application Parameter Block having a size different from that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000010, Rejected - Data size mismatch; If the MMD Download Request Message contains an MMD Application Parameter Block with a parameter value that is out-of-range, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000100, Rejected - Invalid parameter;

3-31

3GPP2 C.S0016-D v2.0 If the MMD Download Request Message contains a MMD Application Parameter Block with a NUM_IMPU or any IMPU_ENTRY_IDX greater than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00100110, Rejected MMD MAX_NUM_IMPU mismatch; If the MMD Download Request Message contains a MMD Application Parameter Block with any IMPU_LENGTH larger than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00100111, Rejected MMD MAX_IMPU_LENGTH mismatch; If the MMD Download Request Message contains a MMD Application Parameter Block with a NUM_P-CSCF or any P-CSCF_ENTRY_IDX greater than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00101000, Rejected MMD MAX_NUM_P-CSCF mismatch; If the MMD Download Request Message contains a MMD Application Parameter Block with any P-CSCF_LENGTH larger than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00101001, Rejected MMD MAX_PCSCF_LENGTH mismatch; If the MMD Download Request Message is not accepted for any other reason, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000001, Rejected Unknown reason; Otherwise, the mobile station shall store the message data in temporary memory, set BLOCK_ID to the received parameter block identifier and set RESULT_CODE to 00000000, Accepted Operation successful. If more than one MMD Download Request Message or parameter block is received containing values for the same indicators, the mobile station shall retain only the most recently received values.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

30 31 32 33 34 35 36 37 38 39

3.3.1.19 System Tag Configuration Request Message Processing 19. System Tag Configuration Request Message: The mobile station shall send a System Tag Configuration Response Message within 750 ms after receiving the message. If either SP_LOCK_STATE = 1, or NAM_LOCK_STATE = 1, or both are set to 1, the mobile station shall set RESULT_CODE in the System Tag Configuration Response Message to 00001010, Rejected - Mobile station locked. The mobile station shall include the requested parameter block with the BLOCK_LEN field set to zero. If both SP_LOCK_STATE and NAM_LOCK_STATE are set to 0, then:

3-32

3GPP2 C.S0016-D v2.0 If the mobile station does not support the requested parameter block, the mobile station shall set RESULT_CODE in the corresponding returned parameter block to 00000111, Rejected - BLOCK_ID value not supported. The mobile station shall include the parameter block with the BLOCK_LEN field set to zero. If the REQUEST_OFFSETr received in the message specifies an offset which is invalid for the current system tag list, the mobile station shall set the RESULT_CODE in the corresponding returned parameter block to 00000010, Rejected - Data size mismatch. The mobile station shall set the BLOCK_ID to the corresponding parameter block identifier, the SEGMENT_OFFSET in the returned Parameter Block to the value of the REQUEST_OFFSETr, the SEGMENT_SIZE to 00000000, and shall include no octets of the system tag list in the returned Parameter Block. Otherwise, if the REQUEST_OFFSETr received in the message is valid for the current system tag list, the mobile station shall set the RESULT_CODE in the System Tag Configuration Response Message to 00000000, Accepted Operation successful for the Parameter Block included in the message. The mobile station shall include the system tag data starting at the offset corresponding to the REQUEST_OFFSETr and not exceeding a maximum number of octets corresponding to the REQUEST_MAX_SIZEr received in the message. The mobile station shall set the SEGMENT_OFFSET in the returned Parameter Block to the value of the REQUEST_OFFSETr received in the message. The mobile station shall set the SEGMENT_SIZE field to the number of octets of the system tag list included in the returned Parameter Block. If the Parameter Block contains the last segment of the system tag list data, the mobile station shall set the LAST_SEGMENT field to 1; otherwise the mobile station shall set the LAST_SEGMENT field to 0 in the returned Parameter Block. 3.3.1.20 System Tag Download Request Message Processing 20. System Tag Download Request Message: The mobile station shall respond to the message with a System Tag Download Response Message within 750 ms. If the System Tag Download Request Message contains a System Tag Parameter Block with a BLOCK_ID that is not supported by the mobile station, the mobile station shall set the RESULT_CODE in the System Tag Download Response Message to 00000111, Rejected - BLOCK_ID value not supported and shall set the BLOCK_ID to the received parameter block identifier. The mobile station shall omit the SEGMENT_OFFSET and the SEGMENT_SIZE fields in the System Tag Download Response Message.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

32 33 34 35 36 37 38 39 40 41

3-33

3GPP2 C.S0016-D v2.0 If the System Tag Download Request Message contains a System Tag Parameter Block having a size different from that supported by the mobile station, the mobile station shall set the RESULT_CODE in the System Tag Download Response Message to 00000010, Rejected - Data size mismatch and shall set the BLOCK_ID to the received parameter block identifier. If the System Tag Download Request Message does not contain a System tag Parameter Block having a BLOCK_ID of 00000001, 00000010, or 00000011, the mobile station shall omit the SEGMENT_OFFSET and SEGMENT_SIZE fields. Otherwise, the mobile station shall perform the following: - If the System Tag Download Request Message contains a System tag Parameter Block having a BLOCK_ID of 00000001, 00000010, or 00000011, the mobile station shall set SEGMENT_OFFSET to the value of SEGMENT_OFFSET received in the message. The mobile station shall set SEGMENT_SIZE to the value of SEGMENT_SIZE received in the message. If SYS_TAG_BLOCK_ID_CURRENTs is not NULLSYS_TAG_BLOCK_ID and the value of the BLOCK_IDr field is not equal to SYS_TAG_BLOCK_ID_CURRENTs, the mobile station shall perform the following: + + Set the RESULT_CODE in the System Tag Download Response Message to 00101010, Rejected Unexpected System Tag BLOCK_ID change. In the System Tag Download Response Message, set the BLOCK_ID to the received parameter block identifier and set the SEGMENT_OFFSET and the SEGMENT_SIZE to 00000000. Discard all the SEGMENT_DATA octets that have been received in a System Tag Download Request Message with the BLOCK_ID field set to 00000001. Set the SYS_TAG_BLOCK_ID_CURRENTs to NULLSYS_TAG_BLOCK_ID.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

+ -

28 29 30 31 32 33 34 35 36 37 38 39

Otherwise, the mobile station shall perform the following: + + Set the SYS_TAG_BLOCK_ID_CURRENTs to the value of the BLOCK_ID field received in the System Tag Download Request Message. If SEGMENT_OFFSET andin conjunction with SEGMENT_SIZE are inconsistent with the system tag list storage capabilities of the mobile station, the mobile station shall set the RESULT_CODE to 00101011, Rejected System Tag format mismatch and shall set the BLOCK_ID to the received parameter block identifier. Otherwise, if SEGMENT_OFFSET andin conjunction with SEGMENT_SIZE are consistent with the system tag list storage capabilities of the mobile station, the mobile station shall store the SEGMENT_DATA octets in temporary memory.

3-34

3GPP2 C.S0016-D v2.0 o If LAST_SEGMENT is equal to 0, the mobile station shall set the RESULT_CODE to 00000000, Accepted - Operation successful and shall set the BLOCK_ID to the received parameter block identifier. If LAST_SEGMENT is equal to 1 or if BLOCK_ID is equal to 00000000 (Home System Tag), the mobile station shall calculate the CRC, as specified in Section 3.5.11.13.5.10.1 for the system tag list stored in temporary memory. If the calculated CRC and received CRC are equalCRC checks, the mobile station shall set the RESULT_CODE to 00000000, Accepted - Operation successful; otherwise, the mobile station shall set the RESULT_CODE to 00001001, Rejected - CRC error and shall discard this segment and all previously assembled segments of the system tag list from the temporary memory. The mobile station shall set the BLOCK_ID to the received parameter block identifier.

1 2 3 4 5 6 7 8 9 10 11 12 13 14

15 16 17 18 19 20 21 22 23 24 25 26 27 28

3.3.1.21 Service Key Generation Request Message Processing 21. Service Key Generation Request Message: The mobile station shall compute the value of the service root key, for each service root key requested, in accordance with 3.3.10.

If the mobile station has not successfully calculated the service key(s) in accordance with 3.3.10, the mobile station shall set RESULT_CODE to 00000001, Rejected - Unknown reason. The mobile station shall then send a Service Key Generation Response Message within 750 ms after receiving this message. If the mobile station has successfully calculated the services root key(s) in accordance with 3.3.109, the mobile station shall set RESULT_CODE to 00000000, Accepted - Operation successful. The mobile station shall then send a Service Key Generation Response Message within 750 ms after receiving this message. 3.3.1.22 MMS Configuration Request Message Processing 22. MMS Configuration Request Message: The mobile station shall send a MMS Configuration Response Message within 750 ms after receiving the message.

29 30 31 32 33 34 35 36 37

If either SP_LOCK_STATE = ,1 or NAM_LOCK_STATE = 1, or both are set to 1, the mobile station shall set the RESULT_CODE in the corresponding returned confirmation blocks to 00001010, Rejected - Mobile station locked. The mobile station shall include all requested parameter blocks with the BLOCK_LEN field set to 00000000. If both SP_LOCK_STATE and NAM_LOCK_STATE are set to 0, then:

3-35

3GPP2 C.S0016-D v2.0 If the mobile station does not support a requested parameter block, the mobile station shall set RESULT_CODE in the corresponding returned confirmation block to 00000111, Rejected - BLOCK_ID value not supported. The mobile station shall include the parameter block with the BLOCK_LEN field set to 00000000. If the requested data blocks exceed the allowable message length, the mobile station shall set RESULT_CODE in the corresponding returned confirmation block to 00000000, Accepted - Operation successful for each Parameter Block included in the message. The mobile station shall include data blocks, in the order requested, up to the maximum number of blocks that fit into the message. If SECURE_MODE_INDS = 1, the mobile station shall set the FRESH_INCL field to 1, include the FRESH field and set it to a 15-bit value selected according to 3.3.8. The mobile station shall encrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks included in the MMS Configuration Response Message. All the encrypted Parameter Blocks and FRESH field shall fit into the MMS Configuration Response Message. Otherwise, the mobile station shall set RESULT_CODE to 00000000, Accepted - Operation successful for each Parameter Block included in the corresponding confirmation block. The mobile station shall include complete data blocks, in the order requested, in the MMS Configuration Response Message. If SECURE_MODE_INDS = 1, the mobile station shall set the FRESH_INCL field to 1, and include the FRESH field and set it to a 15-bit value selected according to 3.3.8. The mobile station shall encrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks included in the MMS Configuration Response Message.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

3.3.1.23 MMS Download Request Message Processing 23. MMS Download Request Message : The mobile station shall respond to the message with a MMS Download Response Message within 750 ms. If FRESH_INCLr = 1, the mobile station shall set FRESHS = FRESHr. If the SECURE_MODE_INDS = 1, the mobile station shall decrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks received in the MMS Download Request Message. If the MMS Download Request Message contains an MMS URI Parameter Block with a BLOCK_ID that is not supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000111, Rejected - BLOCK_ID value not supported If the MMS Download Request Message contains an MMS URI Parameter Block having a size different from that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000010, Rejected - Data size mismatch

3-36

3GPP2 C.S0016-D v2.0 If the MMS Download Request Message contains an MMS URI Parameter Block with a parameter value that is out-of-range, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000100, Rejected - Invalid parameter If the MMS Download Request Message contains a MMS URI Parameter Block with a NUM_MMS_URI greater than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00101100, Rejected NUM_MMS_URI mismatch If the MMS Download Request Message contains a MMS URI Parameter Block with any MMS_URI _LENGTH larger than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00101101, Rejected MMS_URI _LENGTH mismatch; If the MMS Download Request Message contains a MMS URI Parameter Block with an invalid MMS_URI, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00101110, Rejected Invalid MMS_URI If the MMS Download Request Message is not accepted for any other reason, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000001, Rejected Unknown reason; Otherwise, the mobile station shall store the message data in temporary memory, set BLOCK_ID to the received parameter block identifier and set RESULT_CODE to 00000000, Accepted Operation successful. If more than one MMS Download Request Message or parameter block is received containing values for the same indicators, the mobile station shall retain only the most recently received values.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

26 27 28 29 30 31 32 33 34 35 36 37 38 39

3.3.1.24 MMSS Configuration Request Message Processing MMSS Configuration Request Message: The mobile station shall send an MMSS Configuration Response Message within 750 ms after receiving the message. If either SP_LOCK_STATE = 1, or NAM_LOCK_STATE = 1, or both are set to 1, the mobile station shall set the RESULT_CODE in the corresponding returned confirmation blocks to 00001010, Rejected - Mobile station locked. The mobile station shall include all requested parameter blocks with the BLOCK_LEN field set to 00000000. If both SP_LOCK_STATE and NAM_LOCK_STATE are set to 0, then: If the mobile station does not support a requested parameter block, the mobile station shall set RESULT_CODE in the corresponding returned confirmation block to 00000111, Rejected - BLOCK_ID value not supported. The mobile station shall include the parameter block with the BLOCK_LEN field set to 00000000.

3-37

3GPP2 C.S0016-D v2.0 If the requested data blocks exceed the allowable message length, the mobile station shall set RESULT_CODE in the corresponding returned confirmation block to 00000000, Accepted - Operation successful for each Parameter Block included in the message. The mobile station shall include data blocks, in the order requested, up to the maximum number of blocks that fit into the message. If SECURE_MODE_INDS = 1, the mobile station shall set the FRESH_INCL field to 1, include the FRESH field and set it to a 15-bit value selected according to 3.3.8. The mobile station shall encrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks included in the MMSS Configuration Response Message. All the encrypted Parameter Blocks and FRESH field shall fit into the MMSS Configuration Response Message. Otherwise, the mobile station shall set RESULT_CODE to 00000000, Accepted - Operation successful for each Parameter Block included in the corresponding confirmation block. The mobile station shall include complete data blocks, in the order requested, in the MMSS Configuration Response Message. . If SECURE_MODE_INDS = 1, the mobile station shall set the FRESH_INCL field to 1, and include the FRESH field and set it to a 15-bit value selected according to 3.3.8. The mobile station shall encrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks included in the MMSS Configuration Response Message.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

3.3.1.25 MMSS Download Request Message Processing MMSS Download Request Message: The mobile station shall send an MMSS Download Response Message within 750 ms after receiving the message. If FRESH_INCLr = 1, the mobile station shall set FRESHS = FRESHr. If the SECURE_MODE_INDS = 1, the mobile station shall decrypt as specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks received in the MMSS Download Request Message.

If the MMSS Download Request Message contains an MMSS Parameter Block with a BLOCK_ID that is not supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000111, Rejected - BLOCK_ID value not supported; If the MMSS Download Request Message contains an MMSS Parameter Block having a size different from that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000010, Rejected - Data size mismatch; If the MMSS Download Request Message contains an MMSS Parameter Block with a parameter value that is out-of-range, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00000100, Rejected - Invalid parameter; If the MMSS Download Request Message contains an MMSS Parameter Block with any NUM_MLPL_RECS larger than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier

3-38

3GPP2 C.S0016-D v2.0 and RESULT_CODE to 00101111, Rejected MMSS NUM_MLPL_REC mismatch; If the MMSS Download Request Message contains an MMSS Parameter Block with any NUM_MSPL_RECS larger than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00110000, Rejected MMSS NUM_MSPL_RECS mismatch;" If the MMSS Download Request Message contains an MMSS Parameter Block with a NUM_WLAN_AIR_INT greater than that supported by the mobile station, the mobile station shall set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 00110001, Rejected MMSS NUM_WLAN_AIR_INT mismatch; If the MMSS Download Request Message is not accepted for any other reason, the mobile station shall set BLOCK_ID to the received parameter block identifier RESULT_CODE to 00000001, Rejected Unknown reason; Otherwise, the mobile station shall store the message data in temporary memory, set BLOCK_ID to the received parameter block identifier and set RESULT_CODE to 00000000, Accepted Operation successful. If the BLOCK_ID field in the MMSS Download Request Message is equal to 00000001 or 00000010 (MMSS Location Associated Priority List Parameter Block or MMSS System Priority List Parameter Block, respectively), the mobile station shall perform the following: - The mobile station shall set SEGMENT_OFFSET to the value of SEGMENT_OFFSET received in the message. The mobile station shall set SEGMENT_SIZE to the value of SEGMENT_SIZE received in the message. If SEGMENT_OFFSET andin conjunction with SEGMENT_SIZE are inconsistent with the MLP_LISTs-p (or MSP_LISTs-p) storage capabilities of the mobile station, the mobile station shall set the RESULT_CODE to 00110100, Rejected - MLPL length mismatch (or to 00110101, Rejected - MSPL length mismatch) and shall set the BLOCK_ID to the received parameter block identifier. Otherwise, if SEGMENT_OFFSET andin conjunction with SEGMENT_SIZE are consistent with the MLP_LISTs-p and MSP_LISTs-p storage capabilities of the mobile station, the mobile station shall store the SEGMENT_DATA octets in temporary memory. o If LAST_SEGMENT is equal to 0, the mobile station shall set the RESULT_CODE to 00000000, Accepted - Operation successful and shall set the BLOCK_ID to the received parameter block identifier.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38

3-39

3GPP2 C.S0016-D v2.0 o If LAST_SEGMENT is equal to 1, the mobile station shall calculate the CRC, as specified in Section 3.5.14.1 for the MMSS Location Associated Priority List if the BLOCK_ID = 00000001 (or MMSS System Priority List if the BLOCK_ID = 00000010) stored in temporary memory. If the CRC checks, the mobile station shall set the RESULT_CODE to 00000000, Accepted - Operation successful; otherwise, the mobile station shall set the RESULT_CODE to 00001001, Rejected - CRC error and shall discard this segment and all previously assembled segments of the MMSS Location Asociated Priority List if the BLOCK_ID = 00000001 (or MMSS System Priority List if the BLOCK_ID = 00000010) from temporary memory. The mobile station shall set the BLOCK_ID to the received parameter block identifier.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

If more than one MMSS Download Request Message or parameter block is received containing values for the same indicators, the mobile station shall retain only the most recently received values. If the mobile station receives an OTASP Data Message that it does not recognize or which requires a capability that is not supported, the mobile station shall discard the message and shall send a Mobile Station Reject Order with ORDQ set to 00000110 within T56m seconds (see [7]).

24 25 26 27 28 29 30 31 32 33 34 35 36

3.3.2 Mobile Station SSD Update and Re-authentication Re-authentication is the process by which the mobile station is instructed to perform authentication and generate the Private Long Code Mask (CDMA only) and Message Encryption parameters while on the CDMA Traffic channel or analog voice channel. The authentication key, A-key, may be generated by the mobile station during the programming session. Shared Secret Data, SSD, is generated prior to performing re-authentication. If the mobile station has not generated an A-key during the present programming session via the Key Generation Request Message, the mobile station shall follow the procedures specified in 6.3.12 of [1] or 2.3.12 of [1] when performing an SSD update. If the mobile station has correctly generated an A-key during the present programming session, the mobile station shall follow the procedures specified in 6.3.12 of [1] or 2.3.12 of [1] when performing an SSD update with the following exceptions: The mobile station shall use A_KEY_TEMPs as the A-key input. The mobile station shall store the SSD_A_NEW and SSD_B_NEW outputs in SSD_As and SSD_Bs, respectively, rather than in SSD_As-p and SSD_Bs-p.

37 38

3-40

3GPP2 C.S0016-D v2.0 Once SSD has been generated from A_KEY_TEMPs, the mobile station shall use SSDs instead of SSDs-p until SSDs is stored into SSDs-p after receiving a Commit Request Message. The authentication algorithms are described in [2]. The interface for the algorithms is described in [2]. Re-authentication should be performed as follows: In the mobile station, Set the input parameters of the Auth_Signature procedure (see [2]) as follows If the programming session was initiated by the network as described in 3.2.2, the input parameters shall be set as defined in 6.3.12.1.7 of [1]TIA/EIA-95B. If the programming session was initiated by the user as described in 3.2.1, the input parameters shall be set as defined in 6.3.12.1.6 of [1]TIA/EIA-95B.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

Execute the Auth_Signature procedure; Set AUTHRs equal to the 18-bit output AUTH_SIGNATURE; Send AUTHRs, RANDC (eight most significant bits of RANDs), AUTH_DATAs and COUNTs-p to the base station in the Re-Authenticate Response Message.

17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

At the base station, Compare the received values for RANDC, and optionally COUNT, with the internally stored values associated with the mobile station being activated; Compute AUTHR as described above, except use the internally stored value of SSD_A; Compare the value for AUTHR computed internally with the value of AUTHR received from the mobile station.

If the comparisons executed at the base station are successful, the base station may activate Message Encryption (see 3.3.3) and may also activate Voice Privacy (see 3.3.4). The base station may issue a Parameter Update Order to the mobile station on the Forward Voice Channel or on the Forward Traffic Channel, updating the value of COUNTs-p in the mobile station. If any of the comparisons fail, the base station may deny activation, initiate the Unique Challenge-Response Procedure (see 6.3.12.1.5 of [1] or 2.3.12.1.4 of [1]) or commence the process of updating SSD (see 6.3.12.1.5 of [1] or 2.3.12.1.9 of [1]). 3.3.3 Activation of Message Encryption To enhance the security of the programming session and to protect sensitive subscriber information, a method is provided to encrypt certain fields of selected OTASP Traffic Channel and Forward and Reverse Voice Channel messages (see [1) for details]. Message encryption is controlled on a per-call basis. If message encryption was activated (see 2.3.12.2.1 and 6.3.12.2 of [1] or 2.3.12.2 of [1]) or transition to the Private Long Code Mask was made (see 6.3.12.3 of [1] or 2.3.12.3 of [1])

32 33 34 35 36 37 38

3-41

3GPP2 C.S0016-D v2.0 before the re-authentication operation, the message encryption parameters active at that time shall remain unchanged for the duration of the call. Otherwise, the message encryption parameters are re-calculated during the reauthentication operation. In this case, the data used to initialize the algorithm for calculating the message encryption parameters is computed based on parameters in effect at the time the AUTHR included in Re-Authenticate Response Message was computed. 3.3.4 Activation of Voice Privacy To enhance the security of the programming session and to protect sensitive subscriber information, voice privacy is provided in the CDMA system (see 6.3.12.3 of [1] or 2.3.12.3 of [1]) by means of the Private Long Code Mask used for PN spreading. The generation of the Private Long Code Mask is specified in [1, 1]. If transition to the Private Long Code Mask was made (see 6.3.12.3 of [1] or 2.3.12.3 of [1]), or if signaling message encryption was activated (see 2.3.12.2.1 and 6.3.12.2 of [1] or 2.3.12.2 of [1]) before the re-authentication operation, the Private Long Code Mask active at that time shall remain unchanged for the duration of the call. Otherwise, the Private Long Code Mask shall be recalculated during the re-authentication operation. In this case, the data used to initialize the algorithm for calculating the Private Long Code Mask is computed based on parameters in effect at the time the AUTHR included in the Re-Authenticate Response Message was computed. 3.3.5 System Selection for Preferred Roaming The goal of System Selection for Preferred Roaming (SSPR) is for the mobile station to acquire the most preferred system using the information from the preferred roaming list (PR_LISTs-p) stored in the mobile station (see 3.5.5). Annex C contains information on the recommended use of the preferred roaming list. 3.3.6 Service Programming Lock Access to the mobile station programming module containing NAM indicators and parameters (see 4.5.2, 4.5.3 and 4.5.4) that can be assigned values using Over-the-Air Service Provisioning is protected by the service programming lock. The service programming lock parameter contains the Service Programming Code (SPC) used for unlocking the mobile station parameters for programming or reprogramming. The service programming lock based on a single SPC protects parameters of all NAMs in the mobile station. The SPC has values defined in the Table 3.3.6-1.

1 2 3 4 5 6

7 8 9 10 11 12 13 14 15 16 17 18 19

20 21 22 23 24

25 26 27 28 29 30 31 32 33

3-42

3GPP2 C.S0016-D v2.0 Table 3.3.6-1 Service Programming Code Values Service Programming Code Type Default Active
2 3 4 5 6 7 8 9 10 11 12

SPC Value 0 1 through 999,999

The mobile station should provide the user a means to program the mobile station to accept or deny the SPC change from the default value to a non-default value. The mobile station should be programmed by default to deny the SPC change from the default value to a non-default value. When SPC is set to the default value, all programmable modules in the mobile station are unlocked, unless protected by SPASM (see 3.3.7). When programmable modules are unlocked, access and programming of all NAM indicators and parameters are allowed. When SPC is set to any value other than the default value, the programming module in the mobile station is locked, and access to NAM indicators and parameters can be allowed only if correct value of the SPC is received from the base station within the current OTASP session. 3.3.7 Subscriber Parameter Administration Security Mechanism In order to validate SPASM, the mobile station shall set the input parameters of the Auth_Signature procedure (see [2]) as follows: The mobile station shall set the RAND_CHALLENGE input parameter to the 32-bit random value that is sent to the base station in the RAND_OTAPA field of the OTAPA Response Message, the AUTH_DATA input parameter as defined in 6.3.12.1.7 of [1]TIA/EIA-95B, the SSD_AUTH input parameter to the exclusive OR of SSD_As-p and A-keyA_KEY, the ESN input parameter to the mobile station ESN and the SAVE_REGISTERS input parameter to FALSE. If the mobile station only supports MEID, then Pseudo-ESN shall be used as the ESN. The mobile station shall execute the Auth_Signature procedure. to the computed 18-bit result AUTH_SIGNATURE. Upon receiving the RAND_OTAPA from the mobile station in the OTAPA Response Message, the base station shall compute AUTH_OTAPA as described above with the exception of using the SSD_AUTH input parameter set to the exclusive OR of the internally stored value of SSD_A and A-keyA_KEY. The AUTH_OTAPA is set to the computed 18-bit result AUTH_SIGNATURE and is sent to the mobile station in the Validate SPASM Parameter Block of the Validation Request Message. The mobile station validates SPASM by comparing the AUTH_OTAPAr received in the message to its locally computed value of the AUTH_OTAPAs. The AUTH_OTAPAs is set

13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

3-43

3GPP2 C.S0016-D v2.0 3.3.8 Secure Mode To enhance security of the programming session and to protect sensitive subscriber information, a method is provided to encrypt PARAM_DATA fields of Parameter Blocks in OTASP messages irrespective of the air interface message encryption described in 3.3.3. This method allows setting up a secure tunnel between the mobile station and the network based Over-The-Air Service Provisioning entity. If the mobile station supports Secure Mode, it shall indicate it to the base station in the Protocol Capability Response Message by setting appropriate feature-related fields. When the mobile station is unlocked, i.e. when both SP LOCK_STATES and NAM_LOCK_STATES are equal to 0, the base station can initiate the Secure Mode by sending the Secure Mode Request Message to the mobile station with the START_STOP field set to 1. The mobile station shall use the RAND_SMr received in the message and the SSDs-p to compute the Secure Mode Ciphering Key SMCKs as specified in 3.3.8.1. The mobile station shall use the SMCKs as a key for encryption and decryption, as specified in 3.3.8.2, of all PARAM-DATA of all Parameter Blocks sent and received by the mobile station in the OTASP Data Messages while the Secure mode is active. When encrypting the message, the mobile station shall select a value of FRESH associated with this message and unique for the duration of Secure Mode session. The value of FRESH can be selected at random, or can be set to a monotonically increasing counter. When decrypting the message, the mobile station shall use the value of FRESHr received in the message. The base station can terminate the Secure Mode by sending the Secure Mode Request Message to the mobile station with the START_STOP field set to 0. When Secure Mode session is terminated, the mobile station shall reset the SMCKs to NULL. 3.3.8.1 Generation of Secure Mode Ciphering Key The Secure Mode Ciphering Key Generation SMCKs is generated by the algorithmic function specified in Section 2.2.2.6 of [8]. If KEY_IN_USE = 0000, the input parameters to the algorithmic function f3 shall be set as follows: The K parameter shall be set to SSD-As-p|SSD-Bs-p. The fi parameter shall be set to 0x45. The RAND parameter shall be set to RAND_SMr|RAND_SMr. The Fmk parameter shall be set to 0x41484147. If KEY_IN_USE = 0001, the input parameters to the algorithmic function f3 shall be set as follows: The K parameter shall be set to the 128-bit Root Key K. The fi parameter shall be set to 0x45.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

26 27 28 29 30 31 32 33 34 35 36 37 38

3-44

3GPP2 C.S0016-D v2.0 The RAND parameter shall be set to RAND_SMr|RAND_SMr. The Fmk parameter shall be set to 0x41484147. The mobile station shall execute the Ciphering Key Generation Procedure as specified in 2.2.2.6 of [8]. The mobile station shall set SMCKs to the computed 128-bit output of f3. The mobile station shall set input parameter to the ESP_privacykey Procedure as follows: The key parameter shall be set to SMCKs.

1 2 3 4 5 6 7

The mobile station shall execute the ESP_privacykey Procedure. 3.3.8.2 Encryption and Decryption of messages in Secure Mode Encryption and decryption of PARAM_DATA information is performed by the Enhanced Privacy Algorithm specified in 2.3.2.2 of [8]. The mobile station shall set input parameters to the Enhanced Privacy Algorithm as follows:

8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

If the mobile station presents the data for encryption, the mobile station shall set the fresh parameter to FRESH| 0|BLOCK_ID; otherwise, if the mobile station presents the data for decryption, the mobile station shall set the fresh parameter to FRESHr| 1|BLOCK_ID; The freshsize parameter shall be set to 3; The buf parameter shall be set to address of the octet containing the first bit of the buffer that contains the data to be encrypted or decrypted. The bit_offset parameter shall be set to the offset between the bit position of the most significant bit of the data to be encrypted/decrypted and the bit position of the most significant bit of the buffer (e.g., if the bit position of the most significant bit of the data to be encrypted/decrypted and the bit position of the most significant bit of the buffer are equal, bit_offset shall be set to 0). The bit_count parameter shall be set to the number of bits of the data to be encrypted/decrypted.

The mobile station shall execute the ESP_maskbits Procedure. 3.3.9 System Tag Indicator The goal of the System Tag capability is to increase the functionality of the Roaming Indicators (ROAM_IND) listed within the Preferred Roaming List. This capability allows the downloading and synchronization of a file of operator-customizable roaming indicators, tailored to the specific capabilities of the mobile station, representing the operator-specific roaming indicators. Once configured with a compatible System Tag file associated with the Preferred Roaming List stored within the mobile station, the mobile station shall determine the roaming indicator (ROAM_IND) listed within the System Record or Extended System Record entry

29 30 31 32 33 34 35 36 37

3-45

3GPP2 C.S0016-D v2.0 (see 3.5.5.3.1 and 3.5.5.3.2, respectively) corresponding to the SID of the system in which the mobile station is operating. The mobile station shall then use this ROAM_IND to determine the appropriate user interface actions (graphical and/or textual display) to take as defined by the corresponding ROAM_IND entry within the System Tag file. 3.3.10 Generation of Service Keys Generation of service keys consists of generating an intermediate key and using the intermediate key to generate service keys. 3.3.10.1 Generation of Intermediate Key The Intermediate value ITM_RAND is generated by the algorithmic function specified in Section 2.2.2.2 of [8]. The input parameters to the algorithmic function f0 shall be set as follows: The K parameter shall be set to RKP. The fi parameter shall be set to 0x41. The Fmk parameter shall be set to 0x534B474B. The mobile station shall execute f0 twice. ITM_RAND is set to the 128-bit output of f0. 3.3.10.2 Generation of Service Keys For each bit in the bitmap as illustrated in Table 4.5.1.22-1 that is turned on, the base station shall generate the service key by invoking the key generation function as specified in Section 2.2.2.6 of [8]. The input parameters to the algorithmic function f3 shall be set as follows: The K parameter shall be set to ITM_RAND. The fi parameter shall be set to 0x45. The RAND parameter shall be set according to table 4.3.6.2-1, with remaining least significant bits padded with 0, for each service requested. The Fmk parameter shall be set to 0x534B474B. The mobile station shall execute f3 to produce 128-bit service root key.

1 2 3 4

5 6 7

8 9 10 11

12

13 14 15

16 17 18 19 20 21 22 23 24 25 26

3-46

3GPP2 C.S0016-D v2.0 Table 3.3.10.2-1 Key Identifier Table Service Key Requested IMS ROOT KEY BCMCS ROOT KEY WLAN ROOT KEY
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

RAND Value 0x494D53 0x42434D4353 0x574C414E

3.4 Termination of the Programming Procedure If the mobile station does not support concurrent services, if the mobile station enters any substate or task other than the CDMA Conversation Substate or the analog Conversation Task, the mobile station shall terminate the programming session. Following a CDMA-to-analog handoff, the mobile station may terminate the programming session; however, the mobile station shall not autonomously release the call. If the mobile station receives more than five Validation Request Messages during the same programming session with the SPCr value not equal to the SPCp, the mobile station should terminate the programming session and should not begin another session until after the mobile station power is cycled. If more than five validations of SPASM (see 3.3.7) result in a mismatch during the same programming session, the mobile station should terminate the programming session and should not begin another session until after the mobile station power is cycled. The mobile station shall provide a means for the user to end the programming session. If the user directs the mobile station to end the programming process, the mobile station shall release the call and shall terminate the programming session. If the programming session was initiated by the network as described in 3.2.2, and if the mobile station is directed by the user to initiate a call during the OTAPA session, the mobile station may initiate the call by sending an Enhanced Origination Message if both mobile station and the base station supports concurrent service; otherwise, the mobile station shall terminate the OTAPA session and release the OTAPA call prior to proceeding with the origination procedure. If the mobile station receives the OTAPA Request Message with the START_STOPr equal to 0, it shall terminate the OTAPA session. If the programming session is terminated, the mobile station shall discard all the NAM indicator values that are not stored in permanent memory.

3-47

3GPP2 C.S0016-D v2.0 3.5 Reverse Link Message Formats The reverse link OTASP Data Messages are summarized in Table 3.5-1. Table 3.5-1 Reverse Link Messages Message Name Configuration Response Message Download Response Message MS Key Response Message Key Generation Response Message Re-Authenticate Response Message Commit Response Message Protocol Capability Response Message SSPR Configuration Response Message SSPR Download Response Message Validation Response Message OTAPA Response Message PUZL Configuration Response Message PUZL Download Response Message 3GPD Configuration Response Message 3GPD Download Response Message Secure Mode Response Message Extended Protocol Capability Response Message MMD Configuration Response Message MMD Download Response Message System Tag Configuration Response Message OTASP_MSG_TYPE 00000000 00000001 00000010 00000011 00000100 00000101 00000110 00000111 00001000 00001001 00001010 00001011 00001100 '00001101' '00001110' 00001111 00010000 00010001 00010010 00010011 Reference 3.5.1.1 3.5.1.2 3.5.1.3 3.5.1.4 3.5.1.5 3.5.1.6 3.5.1.7 3.5.1.8 3.5.1.9 3.5.1.10 3.5.1.11 3.5.1.12 3.5.1.13 3.5.1.14 3.5.1.15 3.5.1.16 3.5.1.17 3.5.1.18 3.5.1.19 3.5.1.20

1 2 3

3-48

3GPP2 C.S0016-D v2.0

Message Name System Tag Download Response Message Service Key Generation Response Message MMS Configuration Response Message MMS Download Response Message MMSS Configuration Response Message MMSS Download Response Message Reserved for future standardization Reserved for manufacturerspecific OTASP Data Message definition Reserved for future standardization Available for manufacturerspecific OTASP Data Message definition Reserved
1

OTASP_MSG_TYPE 00010100 00010101 00010110 00010111 00011000 00011001 00011010 through 01111111 10000000

Reference 3.5.1.21 3.5.1.22 3.5.1.23 3.5.1.24 3.5.1.25 3.5.1.26

See [4]

10000001 through 10111111 11000000 through 11111110 11111111 See [4]

3-49

3GPP2 C.S0016-D v2.0

3.5.1 Message Contents 3.5.1.1 Configuration Response Message The Configuration Response Message has the following variable-length format: Field OTASP_MSG_TYPE (00000000) NUM_BLOCKS 8 8 Length (bits)

2 3

NUM_BLOCKS occurrences of the following parameter block: BLOCK_ID BLOCK_LEN PARAM_DATA 8 8 8 BLOCK_LEN

NUM_BLOCKS occurrences of the following field RESULT_CODE 8

FRESH_INCL FRESH RESERVED

4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

1 0 or 15 0 or 7

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The mobile station shall set this field to 00000000. Number of parameter blocks. The mobile station shall set this field to the number of parameter blocks contained in the Configuration Response Message.

BLOCK_ID

Parameter block identifier. The mobile station shall set this field to the value of the BLOCK_ID field of the corresponding parameter block in the Configuration Request Message that is being confirmed (see Table 3.5.2-1).

BLOCK_LEN

Parameter block length. The mobile station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields.

PARAM_DATA

Parameter data fields. The mobile station shall include the parameter block (see 3.5.2) specified by the BLOCK_ID field. If SECURE_MODE_INDS = 1, PARAM_DATA fields shall be encrypted as specified in 3.3.8.

3-50

3GPP2 C.S0016-D v2.0 RESULT_CODE Configuration result code. The mobile station shall include one instance of this field for each parameter block included in the message, in the same order of appearance. The mobile station shall set this field to indicate acceptance or rejection status of the request for the corresponding parameter block in the Configuration Request Message, using the values defined in Table 3.5.1.2-1. FRESH_INCL FRESH included indicator. If SECURE_MODE_INDS = 1, the mobile station shall set this field to 1; otherwise the mobile station shall set this field to 0. FRESH Cryptographic Synchronizer (crypto-sync) selected encrypting PARAM_DATA fields of the message. for

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

If FRESH_INCL = 1, the mobile station shall include this field and set it to a 15-bit value chosen according to requirements defined in Section 3.3.8 for encrypting the PARAM_DATA fields of all Parameter Data blocks included in the message; otherwise the mobile station shall omit this field. RESERVED Reserved bits. If FRESH_INCL = 1, the mobile station shall omit this field; otherwise, the mobile station shall set all the bits of this field to 0. 3.5.1.2 Download Response Message The Download Response Message has the following variable-length format: Field OTASP_MSG_TYPE (00000001) NUM_BLOCKS 8 8 Length (bits)

23 24

NUM_BLOCKS occurrences of the following confirmation block: BLOCK_ID RESULT_CODE

25 26 27 28 29 30 31

8 8

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The mobile station shall set this field to 00000001. Number of parameter blocks. The mobile station shall set this field to the number of parameter blocks contained in the Download Request Message that is being confirmed.

BLOCK_ID

Parameter block identifier.

3-51

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the value of the BLOCK_ID field of the corresponding parameter block in the Download Request Message that is being confirmed (see Table 4.5.2-1). RESULT_CODE Download result code. The mobile station shall set this field to indicate acceptance or rejection status of the corresponding parameter block in the Download Request Message that is being confirmed, using the values defined in Table 3.5.1.2-1.

1 2 3 4 5 6 7 8 9

3-52

3GPP2 C.S0016-D v2.0 Table 3.5.1.2-1 Result Codes RESULT_CODE 00000000 00000001 00000010 00000011 00000100 00000101 00000110 00000111 00001000 00001001 00001010 00001011 00001100 00001101 00001110 00001111 00010000 00010001 '00010010' '00010011' '00010100' '00010101' '00010110' '00010111' '00011000' '00011001' Message Parameter Description Accepted - Operation successful Rejected - Unknown reason Rejected - Data size mismatch Rejected - Protocol version mismatch Rejected - Invalid parameter Rejected - SID/NID length mismatch Rejected - Message not expected in this mode Rejected - BLOCK_ID value not supported Rejected - Preferred roaming list length mismatch Rejected - CRC error Rejected - Mobile station locked Rejected - Invalid SPC Rejected - SPC change denied by the user Rejected - Invalid SPASM Rejected - BLOCK_ID not expected in this mode Rejected User Zone already in PUZL Rejected User Zone not in PUZL Rejected No entries in PUZL Rejected - Operation Mode mismatch Rejected - SimpleIPSimple IP MAX_NUM_NAI mismatch Rejected - SimpleIPSimple IP MAX_NAI_LENGTH mismatch Rejected - MobileIPMobile IP MAX_NUM_NAI mismatch Rejected - MobileIPMobile IP MAX_NAI_LENGTH mismatch Rejected - SimpleIPSimple IP PAP MAX_SS_LENGTH mismatch Rejected - SmpleIP CHAP MAX_SS_LENGTH mismatch Rejected - MobileIPMobile IP MAX_MNAAA_SS_LENGTH mismatch

3-53

3GPP2 C.S0016-D v2.0

RESULT_CODE '00011010' '00011011' '00011100' '00011101' '00011110' '00011111' '00100000' '00100001' '00100010' '00100011' '00100100' '00100101' 00100110 00100111 00101000 00101001 00101010 00101011 00101100 00101101 00101110 00101111 00110000

Message Parameter Description Rejected - MobileIPMobile IP MAX_MNHA_SS_LENGTH mismatch Rejected - MobileIPMobile IP MNAAA_AUTH_ALGORITHM mismatch Rejected - MobileIPMobile IP MNHA_AUTH_ALGORITHM mismatch Rejected - SimpleIPSimple IP ACT_NAI_ENTRY_INDEX mismatch Rejected - MobileIPMobile IP ACT_NAI_ENTRY_INDEX mismatch Rejected - SimpleIPSimple IP PAP NAI_ENTRY_INDEX mismatch Rejected - SimpleIPSimple IP CHAP NAI_ENTRY_INDEX mismatch Rejected - MobileIPMobile IP NAI_ENTRY_INDEX mismatch Rejected Unexpected PRL_BLOCK_ID change Rejected PRL format mismatch Rejected HRPD Access Authentication MAX_NAI_LENGTH mismatch Rejected HRPD Access Authentication CHAP MAX_SS_LENGTH mismatch Rejected MMD MAX_NUM_IMPU mismatch Rejected MMD MAX_IMPU_LENGTH mismatch Rejected MMD MAX_NUM_P-CSCF mismatch Rejected MMD MAX_P-CSCF_LENGTH mismatch Rejected Unexpected System Tag BLOCK_ID Change Rejected System Tag Format mismatch Rejected NUM_MMS_URI mismatch Rejected MMS_URI _LENGTH mismatch Rejected Invalid MMS_URI Rejected MMSS MODE SETTINGS format mismatch Rejected MLPL format mismatch

3-54

3GPP2 C.S0016-D v2.0

RESULT_CODE 00110001 00110010 00110011 00110100 00110101

Message Parameter Description Rejected MSPL format mismatch Rejected MMSS WLAN DOWNLOAD PARAM format mismatch Rejected Secure Mode not active Rejected MLPL length mismatch Rejected MSPL length mismatch

'00110110100011' Reserved for future standardization - 01111111 10000000 11111110 11111111

1

Available for manufacturer-specific Result Code definitions. See [4]. Reserved

2 3

3.5.1.3 MS Key Response Message The MS Key Response Message has the following fixed-length format: Field OTASP_MSG_TYPE (00000010) RESULT_CODE 8 8 Length (bits)

4 5 6 7 8 9 10

OTASP_MSG_TYPE RESULT_CODE

OTASP Data Message type. The mobile station shall set this field to 00000010. Key exchange result code. The mobile station shall set this field to indicate acceptance or rejection status, using the values defined in Table 3.5.1.21.

11 12

3.5.1.4 Key Generation Response Message The Key Generation Response Message has the following variable-length format: Field OTASP_MSG_TYPE (00000011) RESULT_CODE MS_RESULT_LEN MS_RESULT 8 8 8 8 MS_RESULT_LEN Length (bits)

13 14

OTASP_MSG_TYPE

OTASP Data Message type.

3-55

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to 00000011. RESULT_CODE Key exchange result code. The mobile station shall set this field to indicate acceptance or rejection status, using the values defined in Table 3.5.1.21. MS_RESULT_LEN Length of MS_RESULT field. The mobile station shall set this field to the number of octets in the MS_RESULT field. MS_RESULT Mobile station calculation result. If A_KEY_P_REV received in the MS Key Request Message is equal to 00000010, the mobile station shall set this field equal to the value of MS_RESULT as described in 5.1.2. If A_KEY_P_REV received in the MS Key Request Message is equal to 00000011 or 00000100, the mobile station shall set this field equal to the value of MS_RESULT as described in 5.3.2. If A_KEY_P_REV received in the MS Key Request Message is equal to 00000101, the mobile station shall set this field to the value of MS_RESULT as described in 5.5.2. If A_KEY_P_REV received in the MS Key Request Message is equal to 00000111, the mobile station shall set this field to the value of MS_RESULT as described in 5.7.2. If A_KEY_P_REV received in the MS Key Request Message is equal to 00001000, the mobile station shall set this field to the value of MS_RESULT as described in 5.9.2.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

26 27

3.5.1.5 Re-Authenticate Response Message The Re-Authenticate Response Message has the following fixed-length format: Field OTASP_MSG_TYPE (00000100) AUTHR RANDC COUNT AUTH_DATA 8 18 8 6 24 Length (bits)

28 29 30 31 32 33 34

OTASP_MSG_TYPE AUTHR RANDC

OTASP Data Message type. The mobile station shall set this field to 00000100. Authentication signature data. The mobile station shall set this field as specified in 3.3.2. Random challenge value. The mobile station shall set this field as specified in 3.3.2.

3-56

3GPP2 C.S0016-D v2.0 COUNT AUTH_DATA Call history parameter. The mobile station shall set this field as specified in 3.3.2. Authentication Data input parameter. The mobile station shall set this field as specified in 3.3.2. 3.5.1.6 Commit Response Message The Commit Response Message has the following fixed-length format: Field OTASP_MSG_TYPE (00000101) RESULT_CODE
7 8 9 10 11 12 13

1 2 3 4

5 6

Length (bits) 8 8

OTASP_MSG_TYPE RESULT_CODE

OTASP Data Message type. The mobile station shall set this field to 00000101. Data commit result code. The mobile station shall set this field to indicate acceptance or rejection status of the Commit Request Message, using values defined in Table 3.5.1.2-1.

14 15

3.5.1.7 Protocol Capability Response Message The Protocol Capability Response Message has the following variable-length format: Field OTASP_MSG_TYPE (00000110) MOB_FIRM_REV MOB_MODEL NUM_FEATURES 8 16 8 8 Length (bits)

NUM_FEATURES occurrences of the following features: FEATURE_ID FEATURE_P_REV 8 8

ADD_LENGTH Additional fields

16 17 18

8 8 ADD_LENGTH

OTASP_MSG_TYPE

OTASP Data Message type. The mobile station shall set this field to 00000110.

3-57

3GPP2 C.S0016-D v2.0 MOB_FIRM_REV Mobile station firmware revision number. The mobile station shall set this field to the value of the MOB_FIRM_REVp permanent mobile station indicator (see F.2.1 of [1, 1]). MOB_MODEL Mobile station manufacturers model number. The mobile station shall set this field to the value of the MOB_MODELp permanent mobile station indicator (see F.2.1 of [1, 1]). NUM_FEATURES Number of Features. The mobile station shall set this field to the number of features supported by the mobile station using the OTASP protocol with each feature represented by a pair of FEATURE_ID and FEATURE_P_REV fields. A data pair (FEATURE_ID/FEATURE_P_REV) shall not be included if a feature is not supported. If multiple protocol versions are supported, multiple data pairs shall be included, each with the same FEATURE_ID and a different FEATURE_P_REV. The order of the pairs shall have no significance. FEATURE_ID Feature Identifier. The mobile station shall set this field according to Table 3.5.1.7-1 to indicate the feature supported by the mobile station. FEATURE_P_REV Feature protocol version. The mobile station shall set this field according to Table 3.5.1.7-1 to indicate the protocol version of the feature supported by the mobile station.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

3-58

3GPP2 C.S0016-D v2.0 Table 3.5.1.7-1 Feature Identifier Features NAM Download (DATA_P_REV) FEATURE_ID 00000000 FEATURE_P_REV 00000010 FEATURE_P_REV Description NAM Download as specified in this document NAM Download with eHRPD IMSI provisioning as specified in this document A-keyA key provisioning as specified in this document A-keyA key and 3G Root Key provisioning as specified in this document 3G Root Key provisioning as specified in this document Enhanced 3G Root Key provisioning as specified in this document Service Key Generation as specified in this document eHRPD Root Key = A_KEY_P_REV = 00000111 provisioning as specified in this document eHRPD Root Key = A_KEY_P_REV = 00001000 provisioning as specified in this document

00000011

Key Exchange (A_KEY_P_REV)

00000001

00000010

00000011

00000100

00000101

00000110

00000111

00001000

3-59

3GPP2 C.S0016-D v2.0

Features System Selection for Preferred Roaming (SSPR_P_REV)

FEATURE_ID 00000010

FEATURE_P_REV 00000001

FEATURE_P_REV Description System Selection for Preferred Roaming using Preferred Roaming List Reserved System Selection for Preferred Roaming using Extended Preferred Roaming List associated with SSPR_P_REV of 00000011 Service Programming Lock as specified in this document Over-The-Air Service Provisioning as specified in this document Preferred User Zone List as specified in this document 3G Packet Data as specified in this document Secure Mode as specified in this document when root key K is not available Secure Mode as specified in this document when root key K is available MMD as specified in this document System Tag Download as specified in this document MMS as specified in this document MMSS as specified in this document

00000010 00000011

Service Programming Lock (SPL_P_REV) Over-The-Air Service Provisioning (OTASP_P_REV) Preferred User Zone List (PUZL_P_REV) 3G Packet Data (3GPD)

00000011

00000001

00000100

00000001

00000101

00000010

'00000110'

'00000011'

Secure MODE (SECURE_MODE_P_REV)

00000111

00000001

00000010

Multimedia Domain (MMD) System Tag Download (TAG_P_REV) Multimedia Messaging Service (MMS) Multimode System Selection (MMSS_P_REV)

00001000 00001001

00000001 00000001

00001010 00001011

00000001 00000001

3-60

3GPP2 C.S0016-D v2.0

Features Reserved for future standardization Available for manufacturer-specific features Reserved
1 2 3 4 5 6 7 8

FEATURE_ID 000001100 through 10111111 11000000 through 11111110 11111111

FEATURE_P_REV

FEATURE_P_REV Description

See [4]

ADD_LENGTH

Number of octets in the additional fields. The mobile station shall set this field to the number of octets included in the Additional fields.

Additional fields

Additional fields. The mobile station shall include the following field as the first octet of the additional fields. Field BAND_MODE_CAP 8 Length (bits)

9 10 11 12 13 14 15 16 17 18 19

BAND_MODE_CAP

Band/mode Capability Information. The mobile station shall set this field to indicate band and mode capabilities supported by the mobile station. This field consists of the fields as shown in Table 3.5.1.7-2. The mobile station shall set each field to 1 if the corresponding band/mode is supported by the mobile station; otherwise, the mobile station shall set the corresponding field to 0. All bits of the RESERVED field of the BAND_MODE_CAP field shall be set to 0.

3-61

3GPP2 C.S0016-D v2.0 Table 3.5.1.7-2 Band/mode Capability Information Description Band Class 0 Analog Band Class 0 CDMA Band Class 1 CDMA Band Class 3 CDMA Band Class 6 CDMA RESERVED
2

Length (bits) 1 1 1 1 1 3

3 4 5

3.5.1.8 SSPR Configuration Response Message The SSPR Configuration Response Message has the following variable-length format: Field OTASP_MSG_TYPE (00000111) BLOCK_ID RESULT_CODE BLOCK_LEN PARAM_DATA FRESH_INCL FRESH RESERVED 8 8 8 8 8 BLOCK_LEN 1 0 or 15 0 or 7 Length (bits)

6 7 8 9 10 11 12 13 14 15 16 17 18

OTASP_MSG_TYPE BLOCK_ID

OTASP Data Message type. The mobile station shall set this field to 00000111. Parameter Block identifier. The mobile station shall set this field to the value of the BLOCK_ID of the parameter block being returned in this message (see Table 3.5.3-1).

RESULT_CODE

SSPR Configuration result code. The mobile station shall set this field to indicate acceptance or rejection status of the request for corresponding parameter block in the SSPR Configuration Request Message, using the values defined in Table 3.5.1.2-1.

BLOCK_LEN

Parameter block length.

3-62

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields. PARAM_DATA Parameter block data. The mobile station shall include the parameter block specified by the BLOCK_ID field. If SECURE_MODE_INDS = 1, PARAM_DATA fields shall be encrypted as specified in 3.3.8. FRESH_INCL FRESH included indicator. If SECURE_MODE_INDS = 1, the mobile station shall set this field to 1; otherwise the mobile station shall set this field to 0. FRESH Cryptographic Synchronizer (crypto-sync) selected encrypting PARAM_DATA fields of the message. for

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

If FRESH_INCL = 1, the mobile station shall include this field and set it to a 15-bit value chosen according to requirements defined in Section 3.3.8 for encrypting the PARAM_DATA fields of all Parameter Data blocks included in the message; otherwise the mobile station shall omit this field. RESERVED Reserved bits. If FRESH_INCL = 1, the mobile station shall omit this field; otherwise, the mobile station shall set all the bits of this field to 0. 3.5.1.9 SSPR Download Response Message The SSPR Download Response Message has the following variable-length format: Field OTASP_MSG_TYPE (00001000) BLOCK_ID RESULT_CODE 8 8 8 Length (bits)

20 21 22

23 24 25

26 27 28 29

If the BLOCK_ID being confirmed is either 00000000 (Preferred Roaming List) or 00000001 (Extended Preferred Roaming List), the mobile station shall also include the following fields: SEGMENT_OFFSET SEGMENT_SIZE 16 8

30 31 32 33

OTASP_MSG_TYPE BLOCK_ID

OTASP Data Message type. The mobile station shall set this field to 00001000. SSPR Parameter block identifier.

3-63

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the value of the BLOCK_ID field of the parameter block in the SSPR Download Request Message that is being confirmed (see Table 4.5.3-1). RESULT_CODE SSPR Download result code. The mobile station shall set this field to indicate acceptance or rejection status of the parameter block in the SSPR Download Request Message that is being confirmed, using the values defined in Table 3.5.1.2-1. SEGMENT_OFFSET Segment offset. If the BLOCK_ID is either 00000000 (Preferred Roaming List) or 00000001 (Extended Preferred Roaming List), the mobile station shall include and set this field to the value of SEGMENT_OFFSET from the SSPR Download Request Message that is being confirmed; otherwise, the mobile station shall omit this field (See SSPR Download Request Message processing in 3.3.1 for more details). SEGMENT_SIZE Segment size. If the BLOCK_ID is either 00000000 (Preferred Roaming List) or 00000001 (Extended Preferred Roaming List), the mobile station shall include and set this field to the number of octets of the preferred roaming list (PR_LISTs-p) included in SEGMENT_DATA of the SSPR Download Request Message that is being confirmed; otherwise, the mobile station shall omit this field (See SSPR Download Request Message processing in 3.3.1 for more details).

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

27 28 29

3.5.1.10 Validation Response Message The Validation Response Message shall have the following variable-length format:

Field OTASP_MSG_TYPE (00001001) NUM_BLOCKS 8 8

Length (bits)

NUM_BLOCKS occurrences of the following parameter block: BLOCK_ID RESULT_CODE

30 31 32 33

8 8

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The mobile station shall set this field to 00001001. Number of parameter blocks.

3-64

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the number of parameter blocks contained in the Validation Request Message that is being confirmed. BLOCK_ID Parameter block identifier. The mobile station shall set this field to the value of the BLOCK_ID field of the corresponding parameter block in the Validation Request Message that is being confirmed (see Table 4.5.4-1). RESULT_CODE Service programming lock result code. The mobile station shall set this field to indicate acceptance or rejection status of the corresponding parameter block in the Validation Request Message that is being confirmed, using the values defined in Table 3.5.1.2-1.

1 2 3 4 5 6 7 8 9 10 11 12 13 14

15 16 17

3.5.1.11 OTAPA Response Message The OTAPA Response Message shall have the following variable-length format: Field OTASP_MSG_TYPE (00001010) RESULT_CODE RESERVED NAM_LOCK_IND RAND_OTAPA 8 8 7 1 0 or 32 Length (bits)

18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

OTASP_MSG_TYPE RESULT_CODE

OTASP Data Message type. The mobile station shall set this field to 00001010. OTAPA result code. The mobile station shall set this field using the values defined in Table 3.5.1.2-1.

RESERVED NAM_LOCK_IND

Reserved field. The mobile station shall set this field to 0000000 NAM_LOCK indicator. If the mobile station is sending this message in response to the OTAPA Request Message containing the START_STOP field equal to 1, the mobile station shall set this field to 1 if the indicators and parameters of the active NAM are secured by SPASM (see 3.3.7); otherwise, the mobile station shall set this field to 0.

3-65

3GPP2 C.S0016-D v2.0 If the mobile station is sending this message in response to the OTAPA Request Message containing the START_STOP field equal to 0, the mobile station shall set this field to 0. RAND_OTAPA SPASM random challenge. If the NAM_LOCK_IND is equal to 1, the mobile station shall set this field as specified in 3.3.7; otherwise, the mobile station shall omit this field.

1 2 3 4 5 6 7 8

9 10 11

3.5.1.12 PUZL Configuration Response Message The PUZL Configuration Response Message shall have the following variable-length format: Field OTASP_MSG_TYPE (00001011) BLOCK_ID RESULT_CODE BLOCK_LEN PARAM_DATA FRESH_INCL FRESH RESERVED 8 8 8 8 8 BLOCK_LEN 1 0 or 15 0 or 7 Length (bits)

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

OTASP_MSG_TYPE BLOCK_ID

OTASP Data Message type. The mobile station shall set this field to 00001011. Parameter block identifier. The mobile station shall set this field to the value of the BLOCK_ID field of the corresponding parameter block in the PUZL Configuration Request Message that is being confirmed (see Table 3.5.6-1).

RESULT_CODE

Configuration result code. The mobile station shall include one instance of this field for each parameter block included in the message, in the same order of appearance. The mobile station shall set this field to indicate acceptance or rejection status of the request for the corresponding parameter block in the PUZL Configuration Request Message, using the values defined in Table 3.5.1.2-1.

BLOCK_LEN

Parameter block length. The mobile station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields.

3-66

3GPP2 C.S0016-D v2.0 PARAM_DATA Parameter data fields. The mobile station shall include the parameter block specified by the BLOCK_ID field. If SECURE_MODE_INDS = 1, PARAM_DATA field shall be encrypted as specified in 3.3.8. FRESH_INCL FRESH included indicator. If the mobile station supports Secure Mode and if SECURE_MODE_INDS = 1, the mobile station shall set this field to 1; otherwise the mobile station shall set this field to 0. FRESH Cryptographic Synchronizer (crypto-sync) selected encrypting PARAM_DATA fields of the message. for

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

If the mobile station supports Secure Mode, SECURE_MODE_INDS = 1, and FRESH_INCL = 1, the mobile station shall include this field and set it to a 15-bit value chosen according to requirements defined in Section 3.3.8 for encrypting the PARAM_DATA fields of all Parameter Data blocks included in the message; otherwise the mobile station shall omit this field. RESERVED Reserved bits. If FRESH_INCL = 1, the mobile station shall omit this field; otherwise, the mobile station shall set all the bits of this field to 0.

24 25 26

3.5.1.13 PUZL Download Response Message The PUZL Download Response Message shall have the following variable-length format: Field OTASP_MSG_TYPE (00001100) NUM_BLOCKS 8 8 Length (bits)

NUM_BLOCKS occurrences of the following parameter block: BLOCK_ID RESULT_CODE IDS_PRESENT UZ_ID UZ_SID RESERVED
27 28 29

8 8 1 0 or 16 0 or 15 0 or 7

OTASP_MSG_TYPE

OTASP Data Message type. The mobile station shall set this field to 00001100.

3-67

3GPP2 C.S0016-D v2.0 NUM_BLOCKS Number of parameter blocks. The mobile station shall set this field to the number of parameter blocks contained in the PUZL Download Response Message. BLOCK_ID Parameter block identifier. The mobile station shall set this field to the value of the BLOCK_ID field of the corresponding parameter block in the PUZL Download Request Message that is being confirmed (see Table 4.5.6-1). RESULT_CODE PUZL Download result code. The mobile station shall set this field to indicate acceptance or rejection status of the corresponding parameter block in the PUZL Download Request Message that is being confirmed, using the values defined in Table 3.5.1.2-1. IDS_PRESENT Identifiers present flag. The mobile station shall set this field to indicate whether or not the UZ_ID and UZ_SID fields are included in the parameter block. If the UZ_ID and UZ_SID fields are included, IDS_PRESENT = 1; otherwise, IDS_PRESENT = 0. UZ_ID User Zone ID. Identification number for the User Zone. This is used over the air interface to identify the User Zone to the network and the mobile station. The UZ_ID values are defined based on Table 3.5.1.13-1.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

Table 3.5.1.13-1 UZ Type According to UZ_ID UZ_ID Bit # Bit 16 Description of UZ Type 1 indicates a UZ (e.g. HRPD-only) with no 1x SID information included. 0 indicates otherwise. Bit 15 Bit 14 Bit 13 Bits 1 to 12 1 indicates MS-specific usage. 0 indicates otherwise. RESERVED RESERVED Identification of UZ.

27 28 29 30 31

UZ_SID

User Zone System ID. The System Identifier (SID) associated with the User Zone ID. The User Zone ID and User Zone SID values together provide a unique identifier for the user zone.

3-68

3GPP2 C.S0016-D v2.0 RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

1 2 3 4 5 6 7

3.5.1.14 3GPD Configuration Response Message The 3GPD Configuration Response Message has the following variable-length format:

Field OTASP_MSG_TYPE (00001101) NUM_BLOCKS 8 8

Length (bits)

NUM_BLOCKS occurrences of the following parameter block: BLOCK_ID BLOCK_LEN PARAM_DATA RESULT_CODE 8 8 8 BLOCK_LEN 8

FRESH_INCL FRESH RESERVED

9 10 11 12 13 14 15 16 17 18 19 20 21 22

1 0 or 15 0 or 7

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The mobile station shall set this field to 00001101. Number of parameter blocks. The mobile station shall set this field to the number of parameter blocks contained in the 3GPD Configuration Response Message.

The mobile station shall set NUM_BLOCKS occurrences of the following fields: BLOCK_ID Parameter block identifier. The mobile station shall set this field to the value of the BLOCK_ID field of the corresponding parameter block in the 3GPD Configuration Request Message that is being confirmed (see Table 3.5.8-1). BLOCK_LEN Parameter block length.

3-69

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields. PARAM_DATA Parameter data fields. The mobile station shall include the parameter block (see 3.5.8) specified by the BLOCK_ID field. If SECURE_MODE_INDS = 1, PARAM_DATA fields shall be encrypted as specified in 3.3.8. RESULT_CODE Configuration result code. The mobile station shall set this field to indicate acceptance or rejection status of the request for the corresponding parameter block in the 3GPD Configuration Request Message, using the values defined in Table 3.5.1.2-1. FRESH_INCL FRESH included indicator. If SECURE_MODE_INDS = 1, the mobile station shall set this field to SECURE_MODE_IND; otherwise the mobile station shall set this field to 0. FRESH Cryptographic Synchronizer (crypto-sync) selected encrypting PARAM_DATA fields of the message. for

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

If FRESH_INCL = 1, the mobile station shall include this field and set it to a 15-bit value chosen according to requirements defined in Section 3.3.8 for encrypting the PARAM_DATA fields of all Parameter Data blocks included in the message; otherwise the mobile station shall omit this field. RESERVED Reserved bits. If FRESH_INCL = 1, the mobile station shall omit this field; otherwise, the mobile station shall set all the bits of this field to 0.

3.5.1.15 3GPD Download Response Message The 3GPD Download Response Message has the following variable-length format:

32

Field OTASP_MSG_TYPE (00001110) NUM_BLOCKS 8 8

Length (bits)

NUM_BLOCKS occurrences of the following confirmation block: BLOCK_ID RESULT_CODE

33

8 8

OTASP_MSG_TYPE

OTASP Data Message type.

3-70

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to 00001110. NUM_BLOCKS Number of parameter blocks. The mobile station shall set this field to the number of parameter blocks contained in the 3GPD Download Request Message that is being confirmed. The mobile station shall set NUM_BLOCKS occurrences of the following fields: BLOCK_ID Parameter block identifier. The mobile station shall set this field to the value of the BLOCK_ID field of the corresponding parameter block in the 3GPD Download Request Message that is being confirmed (see Table 4.5.7-1). RESULT_CODE Download result code. The mobile station shall set this field to indicate acceptance or rejection status of the corresponding parameter block in the 3GPD Download Request Message that is being confirmed, using the values defined in Table 3.5.1.2-1. 3.5.1.16 Secure Mode Response Message The Secure Mode Response Message shall have the following variable-length format: Field OTASP_MSG_TYPE (00001111) RESULT_CODE
20 21 22 23 24 25 26 27 28

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

17 18 19

Length (bits) 8 8

OTASP_MSG_TYPE RESULT_CODE

OTASP Data Message type. The mobile station shall set this field to 00001111. Secure Mode result code. The mobile station shall set this field using the values defined in Table 3.5.1.2-1.

The mobile station shall add reserved bits, if necessary, in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set these bits to 0000000.

3-71

3GPP2 C.S0016-D v2.0 3.5.1.17 Extended Protocol Capability Response Message The Extended Protocol Capability Response Message has the following variable-length format:

1 2 3

Field OTASP_MSG_TYPE (00010000) OTASP_MOB_P_REV MOB_FIRM_REV MOB_MODEL NUM_FEATURES 8 8 16 8 8

Length (bits)

NUM_FEATURES occurrences of the following features: FEATURE_ID FEATURE_P_REV 8 8

NUM_CAP_RECORDS

NUM_CAP_RECORDS occurrences of the following records: CAP_RECORD_TYPE CAP_RECORD_LEN Type-specific field

5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

8 8 8 RECORD_LEN

OTASP_MSG_TYPE OTASP_MOB_P_REV MOB_FIRM_REV

OTASP Data Message type. The mobile station shall set this field to 00010000. OTASP Mobile Protocol Revision. The mobile station shall set this field to 00000100. Mobile station firmware revision number. The mobile station shall set this field to the value of the MOB_FIRM_REVp permanent mobile station indicator (see F.2.1 of [1, 7]).

MOB_MODEL

Mobile station manufacturers model number. The mobile station shall set this field to the value of the MOB_MODELp permanent mobile station indicator (see F.2.1 of [1, 7]).

NUM_FEATURES

Number of Features. The mobile station shall set this field to the number of features supported by the mobile station using the OTASP protocol.

3-72

3GPP2 C.S0016-D v2.0 FEATURE_ID Feature Identifier. The mobile station shall set this field according to Table 3.5.1.7-1 to indicate the feature supported by the mobile station. FEATURE_P_REV Feature protocol version. The mobile station shall set this field according to Table 3.5.1.7-1 to indicate the protocol version of the feature supported by the mobile station. NUM_CAP_RECORDS Number of Capability Records. The mobile station shall set this field to the number of Capability Records contained in the Extended Protocol Capability Response Message.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

The mobile station shall include all the records requested in the corresponding Protocol Capability Request Message. The mobile station shall include the following fields for each capability record to be included: CAP_RECORD_TYPE Capability Record Type. The mobile station shall set this field to the record type value shown in Table 3.5.1.17.1-1 corresponding to the type of this information record. CAP_RECORD_LEN Capability Record Length. The mobile station shall set this field to the number of octets included in the type-specific fields of this information record. If the mobile station does or not support a a requested requested CAP_RECORD_TYPE supports

CAP_RECORD_TYPE, but does not have a value, the mobile station shall include the CAP_RECORD_TYPE with the CAP_RECORD_LEN field set to 00000000. Type-specific field Type-specific field. The mobile station shall set these fields to the information as specified in 3.5.1.17.1 for the specific type of records.

3-73

3GPP2 C.S0016-D v2.0 3.5.1.17.1 Capability Information Record Table 3.5.1.17.1-1 lists the information record type values that can be used in the Extended Protocol Capability Response Message. The following sections describe the contents of each of the record types in detail.

1 2 3 4 5 6

Table 3.5.1.17.1-1 Capability Information Record Types Capability Information Record Record Type (binary) Operating Mode Information CDMA Band Class Information MEID ICCID EXT_UIM_ID MEID_ME 00000000 00000001 00000010 00000011 00000100 00000101 All other values are reserved.

8 9 10 11

3.5.1.17.1.1 Operating Mode Information This capability information record is used to return operating mode information supported by the mobile station. Type-Specific Field OP_MODE_INFO Length (bits) 8 CAP_RECORD_LEN

12 13 14 15 16 17 18 19

OP_MODE_INFO

Operating mode information. This field indicates which operating modes are supported by the mobile station in the band class for which information is requested. This field currently consists of the following subfields which are included in the information record in the order shown in Table 3.5.1.17.1.1-1.

3-74

3GPP2 C.S0016-D v2.0 Table 3.5.1.17.1.1-1. OP_MODE Subfield OP_MODE0 OP_MODE1 OP_MODE2 RESERVED
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

Length Subfield Description (bits) 1 1 1 5 Analog mode CDMA mode HRPD mode

Standards [22] [7] [9]

The mobile station shall set each subfield to 1, if the corresponding operating mode is supported by the mobile station; otherwise, the mobile station shall set the subfield to 0. RESERVED Reserved bits. The mobile station shall set each bit in this field to 0. When more operating modes are defined, the reserved bits will be used for the new corresponding subfields. Sufficient octets will also be added to this field to accommodate the corresponding new subfields. All the undefined bits in an additional octet will be reserved bits. If all bits are set to 0 in an octet and all succeeding octets, the mobile station shall omit the octet and the succeeding octets.

18 19 20 21

3.5.1.17.1.2 CDMA Band Class Information This capability information record is used to return band class information about the mobile station. Type-Specific Field BAND_CLASS_INFO Length (bits) 8 CAP_RECORD_LEN

22 23 24 25

BAND_CLASS_INFO

Band class information. This field indicates which band classes are supported by the mobile station.

3-75

3GPP2 C.S0016-D v2.0 The mobile station shall set the Nth significant bit of this field to 1 if the Nth band class defined in [23] is supported by the mobile station; otherwise, the mobile station shall set the Nth most significant bit of this field to 0. The mobile station shall add reserved bits as needed in order to make the length of the entire information record equal to an integer number of octets. The mobile station shall set these bits to 0.

1 2 3 4 5 6 7 8 9

10 11 12 13

3.5.1.17.1.3 MEID This capability information record is used to return the mobile station MEID, or the smart cards SF_EUIMID based on the SF_EUIMID Usage Indicator as defined in [24] and [32]. Type-Specific Field MEID Length (bits) 56

14 15 16 17 18 19 20 21 22 23 24 25 26

MEID

Mobile Equipment Identifier. If the mobile station is not smart card enabled, then the mobile station shall set this field to its Mobile Equipment Identifier. If the mobile station is smart card enabled, and if there is no card present, the mobile station shall set this field to its Mobile Equipment Identifier. If the mobile station is smart card enabled, and the the smart card is present, the mobile station shall set this field to its Mobile Equipment Identifier or the SF_EUIMID based on the UIM_ID / SF_EUIMID Usage Indicator defined in [24] and [32].

27 28 29

3.5.1.17.1.4 ICCID This capability information record is used to return the ICCID in the smart card. Type-Specific Field ICCID Length (bits) 80

30 31 32 33

ICCID

Integrated Circuit Card Identifier. The mobile station shall set this field to the Integrated Circuit Card Identifier (LF_EUIMID) stored in the smart card.

3-76

3GPP2 C.S0016-D v2.0 3.5.1.17.1.5 EXT_UIM_ID This capability information record is used to return the EXT_UIM_ID in the smart card based on the SF_EUIMID-based EUIMID service as defined in [24] and [32]. Type-Specific Field EXT_UIM_ID
5 6 7 8 9

1 2 3 4

Length (bits) 8 CAP_RECORD_LEN

EXT_UIM_ID

Mobile station Extended User Identity Module identifier. The mobile station shall set this field according to Table 3.5.1.17.1.5-1. Table 3.5.1.17.1.5-1. EXT_UIM_ID Field Setting SF_EUIMID-based EUIMID 0 1 EXT_UIM_ID LF_EUIMID SF_EUIMID Length (bits) 80 56

10

11 12 13

3.5.1.17.1.6 MEID_ME This capability information record is used to return the mobile station MEID. Type-Specific Field MEID_ME Length (bits) 56

14 15 16 17 18 19

MEID_ME

Mobile Equipment Identifier of ME.

The mobile station shall set this field to the LF_EUIMID when the CAP_Record_LEN is set to 10 octets. The mobile station shall set this field to the SF_EUIMID when the CAP_Record_LEN is set to 7 octets.

3-77

3GPP2 C.S0016-D v2.0 3.5.1.18 MMD Configuration Response Message The MMD Configuration Response Message has the following variable-length format:

1 2

Field OTASP_MSG_TYPE (00010001) NUM_BLOCKS 8 8

Length (bits)

NUM_BLOCKS occurrences of the following parameter block: BLOCK_ID BLOCK_LEN PARAM_DATA RESULT_CODE 8 8 8 BLOCK_LEN 8

FRESH_INCL FRESH RESERVED

4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

1 0 or 15 0 or 7

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The mobile station shall set this field to 00010001. Number of parameter blocks. The mobile station shall set this field to the number of parameter blocks contained in the MMD Configuration Response Message.

The mobile station shall set NUM_BLOCKS occurrences of the following fields: BLOCK_ID Parameter block identifier. The mobile station shall set this field to the value of the BLOCK_ID field of the corresponding parameter block in the MMD Configuration Request Message that is being confirmed (see Table 3.5.9-1). BLOCK_LEN Parameter block length. The mobile station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields. PARAM_DATA Parameter data fields. The mobile station shall include the parameter block (see 3.5.9) specified by the BLOCK_ID field. If SECURE_MODE_INDS = 1, PARAM_DATA fields shall be encrypted as specified in 3.3.8.

3-78

3GPP2 C.S0016-D v2.0 RESULT_CODE Configuration result code. The mobile station shall set this field to indicate acceptance or rejection status of the request for the corresponding parameter block in the MMD Configuration Request Message, using the values defined in Table 3.5.1.2-1. FRESH_INCL FRESH included indicator. If SECURE_MODE_INDS = 1, the mobile station shall set this field to SECURE_MODE_IND; otherwise the mobile station shall set this field to 0. FRESH Cryptographic Synchronizer (crypto-sync) selected encrypting PARAM_DATA fields of the message. for

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

If FRESH_INCL = 1, the mobile station shall include this field and set it to a 15-bit value chosen according to requirements defined in Section 3.3.8 for encrypting the PARAM_DATA fields of all Parameter Data blocks included in the message; otherwise the mobile station shall omit this field. RESERVED Reserved bits. If FRESH_INCL = 1, the mobile station shall omit this field; otherwise, the mobile station shall set all the bits of this field to 0. 3.5.1.19 MMD Download Response Message The MMD Download Response Message has the following variable-length format:

21 22

23

Field OTASP_MSG_TYPE (00010010) NUM_BLOCKS 8 8

Length (bits)

NUM_BLOCKS occurrences of the following confirmation block: BLOCK_ID RESULT_CODE

24 25 26 27 28 29 30 31

8 8

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The mobile station shall set this field to 00010010. Number of parameter blocks. The mobile station shall set this field to the number of parameter blocks contained in the MMD Download Request Message that is being confirmed.

The mobile station shall set NUM_BLOCKS occurrences of the following fields: BLOCK_ID Parameter block identifier.

3-79

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the value of the BLOCK_ID field of the corresponding parameter block in the MMD Download Request Message that is being confirmed (see Table 4.5.8-1). RESULT_CODE Download result code. The mobile station shall set this field to indicate acceptance or rejection status of the corresponding parameter block in the MMD Download Request Message that is being confirmed, using the values defined in Table 3.5.1.2-1. 3.5.1.20 System Tag Configuration Response Message The System Tag Configuration Response Message shall have the following variable-length format: Field OTASP_MSG_TYPE (00010011) BLOCK_ID RESULT_CODE BLOCK_LEN PARAM_DATA
14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

1 2 3 4 5 6 7 8 9

10 11 12 13

Length (bits) 8 8 8 8 8 BLOCK_LEN

OTASP_MSG_TYPE

OTASP Data Message type. The mobile station shall set this field to 00010011. The mobile station shall set this field to the value of the BLOCK_ID field of the corresponding parameter block in the System Tag Configuration Request Message that is being confirmed (see Table 3.5.10-1). System Tag result code. The mobile station shall set this field to indicate acceptance or rejection status of the request for corresponding parameter block in the System Tag Configuration Request Message, using the values defined in Table 3.5.1.2-1.

BLOCK_ID

RESULT_CODE

BLOCK_LEN

Parameter block length. The mobile station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields.

PARAM_DATA

Parameter block data. The mobile station shall include the parameter block specified by the BLOCK_ID field.

3-80

3GPP2 C.S0016-D v2.0 3.5.1.21 System Tag Download Response Message The System Tag Download Response Message shall have the following format: Field OTASP_MSG_TYPE (00010100) BLOCK_ID RESULT_CODE
4 5 6

1 2 3

Length (bits) 8 8 8

If the BLOCK_ID being confirmed is 00000001 (Group Tag List),00000010 (Specific Tag List), or 00000011 (Call Prompt List), the mobile station shall also include the following fields: SEGMENT_OFFSET SEGMENT_SIZE 16 8

7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35

OTASP_MSG_TYPE BLOCK_ID

OTASP Data Message type. The mobile station shall set this field to 00010100. System Tag Parameter block identifier. The mobile station shall set this field to the value of the BLOCK_ID field of the parameter block in the System Tag Download Request Message that is being confirmed (see Table 4.5.9-1).

RESULT_CODE

System Tag Download result code. The mobile station shall set this field to indicate acceptance or rejection status of the parameter block in the System Tag Download Request Message that is being confirmed, using the values defined in Table 3.5.1.2-1.

SEGMENT_OFFSET

Segment offset. If the BLOCK_ID being confirmed is 00000001 (Group Tag List),00000010 (Specific Tag List), or 00000011 (Call Prompt List), the mobile station shall include and set this field to the value of SEGMENT_OFFSET from the System Tag Download Request Message that is being confirmed; otherwise, the mobile station shall omit this field

SEGMENT_SIZE

Segment size. If the BLOCK_ID being confirmed is 00000001 (Group Tag List),00000010 (Specific Tag List), or 00000011 (Call Prompt List), the mobile station shall set this field to the number of octets of the group tag list (GROUP_TAG_LISTs-p), specific tag list (SPEC_TAG_LISTs-p), or call prompt list (CALL_PRMPT_ LISTs-p) included in SEGMENT_DATA of the System Tag Download Request Message that is being confirmed; otherwise, the mobile station shall omit this field.

3-81

3GPP2 C.S0016-D v2.0 3.5.1.22 Service Key Generation Response Message The Service Key Generation Response Message shall have the following format: Field OTASP_MSG_TYPE (00010101) RESULT_CODE
4 5 6 7 8 9 10

1 2 3

Length (bits) 8 8

OTASP_MSG_TYPE RESULT_CODE

OTASP Data Message type. The mobile station shall set this field to 00010101. Service Key Generation result code. The mobile station shall set this field using the values defined in Table 3.5.1.2-1.

11 12 13

3.5.1.23 MMS Configuration Response Message The MMS Configuration Response Message has the following variable-length format: Field OTASP_MSG_TYPE (00010110) NUM_BLOCKS 8 8 Length (bits)

NUM_BLOCKS occurrences of the following parameter block: BLOCK_ID BLOCK_LEN PARAM_DATA RESULT_CODE 8 8 8 BLOCK_LEN 8

FRESH_INCL FRESH RESERVED

14 15 16 17 18 19 20

1 0 or 15 0 or 7

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The mobile station shall set this field to 00010110. Number of parameter blocks. The mobile station shall set this field to the number of parameter blocks contained in the MMS Configuration Response Message.

3-82

3GPP2 C.S0016-D v2.0 BLOCK_ID Parameter block identifier. The mobile station shall set this field to the value of the parameter block type being included in the message (see Table 3.5.12-1). BLOCK_LEN Parameter block length. The mobile station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields. PARAM_DATA Parameter data fields. The mobile station shall include the parameter block specified by the BLOCK_ID field. If Secure Mode is active, PARAM_DATA fields shall be encrypted as specified in 3.3.8. RESULT_CODE Configuration result code. The mobile station shall set this field to indicate acceptance or rejection status of the corresponding parameter block in the MMS Configuration Request Message that is being confirmed, using the values defined in Table 3.5.1.2-1. FRESH_INCL FRESH included indicator. If Secure Mode is active (See 3.3.8), the mobile station shall set this field to 1; otherwise the mobile station shall set this field to 0. FRESH Cryptographic Synchronizer (crypto-sync) selected encrypting PARAM_DATA fields of the message. for

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

If FRESH_INCL = 1, the mobile station shall include this field and set it to a 15-bit value chosen as specified in 3.3.8 for encrypting the PARAM_DATA fields of all Parameter Data blocks included in the message; otherwise the mobile station shall omit this field. RESERVED Reserved bits. If FRESH_INCL= 1, the mobile station shall omit this field; otherwise, the mobile station shall set all the bits of this field to 0.

3-83

3GPP2 C.S0016-D v2.0 3.5.1.24 MMS Download Response Message The MMS Download Response Message has the following variable-length format:

1 2

Field OTASP_MSG_TYPE (00010111) NUM_BLOCKS 8 8

Length (bits)

NUM_BLOCKS occurrences of the following confirmation block: BLOCK_ID RESULT_CODE

4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

8 8

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The mobile station shall set this field to 00010111. Number of parameter blocks. The mobile station shall set this field to the number of parameter blocks contained in the MMS Download Request Message that is being confirmed.

The mobile station shall set NUM_BLOCKS occurrences of the following fields: BLOCK_ID Parameter block identifier. The mobile station shall set this field to the value of the BLOCK_ID field of the corresponding parameter block in the MMS Download Request Message that is being confirmed (see Table 4.5.10-1). RESULT_CODE Download result code. The mobile station shall set this field to indicate acceptance or rejection status of the corresponding parameter block in the MMS Download Request Message that is being confirmed, using the values defined in Table 3.5.1.2-1.

3-84

3GPP2 C.S0016-D v2.0 3.5.1.25 MMSS Configuration Response Message The MMSS Configuration Response Message has the following variable-length format:

1 2 3

Field OTASP_MSG_TYPE (00011000) NUM_BLOCKS

Length (bits) 8 8

NUM_BLOCKS occurrences of the following confirmation block: BLOCK_ID BLOCK_LEN PARAM_DATA RESULT_CODE
4

8 8 8 x BLOCK_LEN 8

FRESH_INCL FRESH RESERVED

5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

1 0 or 15 0 or 7

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The mobile station shall set this field to 00011000. Number of parameter blocks. The mobile station shall set this field to the number of parameter blocks contained in the MMSS Configuration Request Message that is being confirmed.

BLOCK_ID

Parameter block identifier. The mobile station shall set this field to the value of the BLOCK_ID field of the corresponding parameter block in the MMSS Configuration Request Message that is being confirmed (see Table 3.5.13-1).

BLOCK_LEN

Parameter block length. The mobile station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields.

PARAM_DATA

Parameter block data.

3-85

3GPP2 C.S0016-D v2.0 If the BLOCK_ID field is set to 00000010 (MMSS Location Associated Priority List) or 00000011 (MMSS System Priority List), then the mobile station shall include the table below. Otherwise, Tthe mobile station shall include the parameter block specified by the BLOCK_ID field as specified in section 3.5.13. If SECURE_MODE_INDS = 1, PARAM_DATA fields shall be encrypted as specified in section 3.3.8. Field RESERVED LAST_SEGMENT SEGMENT_OFFSET SEGMENT_SIZE SEGMENT_DATA
9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35

1 2 3 4 5 6 7 8

Length (bits) 7 1 16 8 8 SEGMENT_SIZE

RESERVED LAST_SEGMENT

Reserved bits (in PARAM_DATA). The mobile station shall set this field to 0000000. Last segment indicator bit (in PARAM_DATA). The mobile station shall set this field to 1 if SEGMENT_DATA contains the last octet of the MMSS Location Associated Priority List (MLP_LISTS-P) or MMSS System Priority List (MSP_LISTS-P); otherwise, the mobile station shall set this field to 0. The MLP_LISTS-P is defined in Sec. 3.5.13.3 MMSS Location Associated Priority List. The MSP_LISTS-P is defined in Sec. 3.5.13.4.

SEGMENT_OFFSET

Segment offset (in PARAM_DATA). The mobile station shall set this field to the value of the REQUEST_OFFSET from the corresponding MMSS Configuration Request Message.

SEGMENT_SIZE

Segment size (in PARAM_DATA). The mobile station shall set this field to the number of octets of MLP_LISTS-P or MSP_LISTS-P included in SEGMENT_DATA. If REQUEST_OFFSET from the corresponding MMSS Configuration Request Message specifies an offset that is invalid for the current MLP_LISTS-P or MSP_LISTS-P, then the mobile station shall include no octets in this field. If REQUEST_OFFSET specifies an offset that is valid for the current MLP_LISTS-P or MSP_LISTS-P, then the mobile station shall include at most REQUEST_MAX_SIZE sequential octets of the MLP_LISTS-P or MSP_LISTS-P in this field.

SEGMENT_DATA

Segment data (in PARAM_DATA).

3-86

3GPP2 C.S0016-D v2.0 If SEGMENT_SIZE is zero, this field shall be omitted. Otherwise, this field contains SEGMENT_SIZE octets starting at the offset specified by SEGMENT_OFFSET within the MLP_LISTS-P if BLOCK_ID = 00000010 or MSP_LISTS-P if BLOCK_ID = 00000011. RESULT_CODE Service programming lock result code. The mobile station shall set this field to indicate acceptance or rejection status of the corresponding parameter block in the MMSS Configuration Request Message that is being confirmed, using the values defined in Table 3.5.1.2-1. FRESH included indicator. If SECURE_MODE_INDS = 1, the mobile station shall set this field to 1; otherwise the mobile station shall set this field to 0. FRESH Cryptographic Synchronizer (crypto-sync) selected encrypting PARAM_DATA fields of the message. for

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

FRESH_INCL

If FRESH_INCL = 1, the mobile station shall include this field and set it to a 15-bit value chosen according to requirements defined in Section 3.3.8 for encrypting the PARAM_DATA fields of all Parameter Data blocks included in the message; otherwise the mobile station shall omit this field. RESERVED Reserved bits. If FRESH_INCL = 1, the mobile station shall omit this field; otherwise, the mobile station shall set all the bits of this field to 0.

3-87

3GPP2 C.S0016-D v2.0 3.5.1.26 MMSS Download Response Message The MMSS Download Response Message has the following variable-length format:

1 2 3

Field OTASP_MSG_TYPE (00011001) NUM_BLOCKS

Length (bits) 8 8

NUM_BLOCKS occurrences of the following confirmation block: BLOCK_ID RESULT_CODE SEGMENT_OFFSET SEGMENT_SIZE
4

8 8 0 or 16 0 or 8

5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The mobile station shall set this field to 00011001. Number of parameter blocks. The mobile station shall set this field to the number of parameter blocks contained in the MMSS Download Request Message that is being confirmed.

BLOCK_ID

Parameter block identifier. The mobile station shall set this field to the value of the BLOCK_ID field of the corresponding parameter block in the MMSS Download Request Message that is being confirmed (see Table 4.5.11-1).

RESULT_CODE

MMSS Download result code. The mobile station shall set this field to indicate acceptance or rejection status of the corresponding parameter block in the MMSS Download Request Message that is being confirmed, using the values defined in Table 3.5.1.2-1.

If the BLOCK_ID field is set to 00000001 (MMSS Location Associated Priority List), the mobile station shall include the following fields in the message:

SEGMENT_OFFSET

Segment offset.

3-88

3GPP2 C.S0016-D v2.0 If the BLOCK_ID is 00000001 (MMSS Location Associated Priority List), tThe mobile station shall include and set this field to the value of SEGMENT_OFFSET from the MMSS Download Request Message that is being confirmed; otherwise, the mobile station shall omit this field. SEGMENT_SIZE Segment size. If the BLOCK_ID is 00000001 (MMSS Location Associated Priority List), tThe mobile station shall include and set this field to the number of octets of the MMSS location associated priority list included in SEGMENT_DATA of the MMSS Download Request Message that is being confirmed; otherwise, the mobile station shall omit this field.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

If the BLOCK_ID field is set to 00000010 (MMSS System Priority List), the mobile station shall include the following fields in the message:

SEGMENT_OFFSET

Segment offset. If the BLOCK_ID is 00000010 (MMSS System Priority List), tThe mobile station shall include and set this field to the value of SEGMENT_OFFSET from the MMSS Download Request Message that is being confirmed; otherwise, the mobile station shall omit this field.

SEGMENT_SIZE

Segment size. If the BLOCK_ID is 00000010 (MMSS System Priority List), tThe mobile station shall include and set this field to the number of octets of the MMSS systemlocation associated priority list included in SEGMENT_DATA of the MMSS Download Request Message that is being confirmed; otherwise, the mobile station shall omit this field.

If the BLOCK_ID is any value other than 00000001 or 00000010, the mobile station shall omit the SEGMENT_OFFSET and SEGMENT_SIZE fields.

3-89

3GPP2 C.S0016-D v2.0 3.5.2 NAM Parameter Blocks Table 3.5.2-1 lists the types of parameter blocks used in the Configuration Request Message and the Configuration Response Message.

1 2 3 4 5

Table 3.5.2-1 NAM Parameter Block Types Parameter Block Type CDMA/Analog NAM Mobile Directory Number CDMA NAM IMSI_T eHRPD IMSI Reserved for future standardization BLOCK_ID 00000000 00000001 00000010 00000011 00000100 00000101 through 01111111 10000000 through 11111110 11111111 See [4] Reference 3.5.2.1 3.5.2.2 3.5.2.3 3.5.2.4 3.5.2.5

Available for manufacturer-specific parameter block definitions Reserved

6

3-90

3GPP2 C.S0016-D v2.0 3.5.2.1 CDMA/Analog NAM Parameter Block The PARAM_DATA field of this Parameter Block consists of the following fields:

1 2

Field FIRSTCHP HOME_SID EX SCM MOB_P_REV IMSI_M_CLASS IMSI_M_ADDR_NUM MCC_M IMSI__M_11_12 IMSI_M_S ACCOLC LOCAL_CONTROL_ANALOG MOB_TERM_HOME MOB_TERM_FOR_SID MOB_TERM_FOR_NID MAX_SID_NID STORED_SID_NID 11 15 1 8 8 1 3 10 7 34 4 1 1 1 1 8 8

Length (bits)

STORED_SID_NID occurrences of the following SID/NID pair: SID NID 15 16

The parameter block ends with the following field: RESERVED

4 5 6 7 8 9 10

0 to 7 (as needed)

FIRSTCHP

First paging channel used in the home system. The mobile station shall set this field to the value of the FIRSTCHPp NAM indicator (see F.3 of [1, 1]).

HOME_SID

Home system identification. The mobile station shall set this field to the value of the HOME_SIDp NAM indicator (see F.3 of [1, 1]).

3-91

3GPP2 C.S0016-D v2.0 EX Extended address indicator. The mobile station shall set this field to the value of the Exp NAM indicator (see F.3 of [1, 1]). SCM Station class mark. The mobile station shall set this field to the value of the SCMp permanent mobile station indicator (see F.2.1 of [1, 1]). MOB_P_REV Mobile station protocol revision number. The mobile station shall set this field to the value of the MOB_P_REVp permanent mobile station indicator (see F.2.1 of [1, 1]). IMSI_M_CLASS IMSI_M Class assignment of the mobile station. If the mobile stations IMSI_M is a class 0 IMSI, the mobile station shall set this field to 0; otherwise, the mobile station shall set this field to 1. IMSI_M_ADDR_NUM Number of IMSI_M address digits. If the mobile station has been assigned a class 1 IMSI_M (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]), the mobile station shall set this field to four less than the number of digits in the NMSI; otherwise, the mobile station shall set this field to 000. MCC_M Mobile country code. The mobile station shall set this field to the value of the MCC_Mp NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]). IMSI__M_11_12 11th and 12th digits of the IMSI_M. The mobile station shall set this field to the value of the IMSI_M_11_12p NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]). IMSI_M_S The least significant 10 digits of the IMSI_M. The mobile station shall set this field to the value of the IMSI_M_Sp NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]).

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

3-92

3GPP2 C.S0016-D v2.0 ACCOLC Access overload class. The mobile station shall set this field to the value of the ACCOLCp NAM indicator (see F.3 of [1, 1]). The value of ACCOLC may determine the Access Terminal Class (ATC) if ATC is not provisioned in the Access Terminal as described in Section 1.4.6.1.4.1.4 of [34].The mobile station shall set the APersistence[i] (for mobile stations that also support HRPD) as shown in Table 3.5.2.1-1 when ACCOLC is set.

1 2 3 4 5 6 7 8 9 10 11 12

Table 3.5.2.1-1

ACCOLC APersistence[i] Equivalence Table ACCOLC 0 to 9 10, 11 12, 13 14, 15 APersistence[i] 0 1 2 3

13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

LOCAL_CONTROL_ANALOG -

Local control status for Analog operation.

If the local control status for Analog operation is enabled (see 2.6.1.2.2 of [1]), the mobile station shall set this field to 1; otherwise, the mobile station shall set this field to 0. MOB_TERM_HOME Termination indicator for the home system. The mobile station shall set this field to the value of the MOB_TERM_HOMEp NAM indicator (see F.3 of [1, 1]). MOB_TERM_FOR_SID Termination indicator for SID roaming. The mobile station shall set this field to the value of the MOB_TERM_FOR_SIDp NAM indicator (see F.3 of [1, 1]). MOB_TERM_FOR_NID Termination indicator for NID roaming. The mobile station shall set this field to the value of the MOB_TERM_FOR_NIDp NAM indicator (see F.3 of [1, 1]). MAX_SID_NID Maximum stored SID/NID pairs. The mobile station shall set this field to the maximum number of SID/NID pairs that it can store in the NAM. STORED_SID_NID Number of stored SID/NID pairs. The mobile station shall set this field to the number of SID/NID pairs stored in the NAM. All SID/NID pairs stored in the NAM shall be included in the parameter block. SID System identification.

3-93

3GPP2 C.S0016-D v2.0 The mobile station shall include one occurrence of this field for each SID/NID pair stored in the NAM. The mobile station shall set this field to the value of the SIDp NAM indicator (see F.3 of [1, 1]). NID Network identification. The mobile station shall include one occurrence of this field for each SID/NID pair stored in the NAM. The mobile station shall set this field to the value of the NIDp NAM indicator (see F.3 of [1, 1]). RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set these bits to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

16 17 18

3.5.2.2 Mobile Directory Number The PARAM_DATA field of the Mobile Directory Number Parameter Block consists of the following fields: Field N_DIGITS 4 Length (bits)

N_DIGITS occurrences of the following field: DIGITn 4

The parameter block ends with the following field: RESERVED

19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

0 or 4

N_DIGITS

Number of digits. The mobile station shall set this field to the number of digits included in the parameter block.

DIGITn

Digit. The mobile station shall set these fields to the digits of the mobile station directory number. Each digit shall be encoded according to Table 6.7.1.3.2.4-4 of [1] or Table 2.7.1.3.2.4-4 of [1].

RESERVED

Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set these bits to 0.

3-94

3GPP2 C.S0016-D v2.0 3.5.2.3 CDMA NAM Parameter Block The PARAM_DATA field of this Parameter Block consists of the following fields:

1 2

Field RESERVED SLOTTED_MODE RESERVED MOB_P_REV IMSI_M_CLASS IMSI_M_ADDR_NUM MCC_M IMSI_M_11_12 IMSI_M_S ACCOLC LOCAL CONTROLLOCAL_CONTROL_CDMA MOB_TERM_HOME MOB_TERM_FOR_SID MOB_TERM_FOR_NID MAX_SID_NID STORED_SID_NID 2 1 5 8 1 3 10 7 34 4 1 1 1 1 8 8

Length (bits)

STORED_SID_NID occurrences of the following SID/NID pair: SID NID 15 16

The parameter block ends with the following field: RESERVED

4 5 6 7 8 9 10 11 12

0 to 7 (as needed)

RESERVED SLOTTED_MODE

Reserved bits. The mobile station shall set this field to 00. Slotted mode. If the mobile station is operating in the slotted mode, the mobile station shall set this field to 1; otherwise, the mobile station shall set this field to 0.

RESERVED

Reserved bits. The mobile station shall set this field to 00000.

3-95

3GPP2 C.S0016-D v2.0 MOB_P_REV Mobile station protocol revision number. The mobile station shall set this field to the value of the MOB_P_REVp permanent mobile station indicator (see F.2.1 of [1, 1]). IMSI_M_CLASS IMSI_M Class assignment of the mobile station. If the mobile stations IMSI_M is a class 0 IMSI, the mobile station shall set this field to 0; otherwise, the mobile station shall set this field to 1. IMSI_ M_ADDR_NUM Number of IMSI_M address digits. If the mobile station has been assigned a class 1 IMSI_M (see F.3 [1, 1]), the mobile station shall set this field to four less than the number of digits in the NMSI; otherwise, the mobile station shall set this field to 000. MCC_M Mobile country code. The mobile station shall set this field to the value of the MCC_Mp NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]). IMSI_M_11_12 11th and 12th digits of the IMSI. The mobile station shall set this field to the value of the IMSI_M_11_12p NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]). IMSI_M_S The least significant 10 digits of the IMSI. The mobile station shall set this field to the value of the IMSI_M_Sp NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]). ACCOLC Access overload class. The mobile station shall set this field to the value of the ACCOLCp NAM indicator (see F.3 of [1, 1]). The mobile station shall set APersistence[i] (for mobile stations that also support HRPD) as shown in Table 3.5.2.1-1 when ACCOLC is set. LOCAL_ CONTROL_CDMA Local control status for CDMA operation. If the local control status for CDMA operation is enabled (see 6.3.9 of [1] or 2.3.9 of [1]), the mobile station shall set this field to 1; otherwise, the mobile station shall set this field to 0. MOB_TERM_HOME Termination indicator for the home system. The mobile station shall set this field to the value of the MOB_TERM_HOMEp NAM indicator (see F.3 of [1, 1]). MOB_TERM_FOR_SID Termination indicator for SID roaming. The mobile station shall set this field to the value of the MOB_TERM_FOR_SIDp NAM indicator (see F.3 of [1, 1]).

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

3-96

3GPP2 C.S0016-D v2.0 MOB_TERM_FOR_NID Termination indicator for NID roaming. The mobile station shall set this field to the value of the MOB_TERM_FOR_NIDp NAM indicator (see F.3 of [1, 1]). MAX_SID_NID Maximum stored SID/NID pairs. The mobile station shall set this field to the maximum number of SID/NID pairs that it can store in the NAM. STORED_SID_NID Number of stored SID/NID pairs. The mobile station shall set this field to the number of SID/NID pairs stored in the NAM. All SID/NID pairs stored in the NAM shall be included in the parameter block. SID System identification. The mobile station shall include one occurrence of this field for each SID/NID pair stored in the NAM. The mobile station shall set this field to the value of the SIDp NAM indicator (see F.3 of [1, 1]). NID Network identification. The mobile station shall include one occurrence of this field for each SID/NID pair stored in the NAM. The mobile station shall set this field to the value of the NIDp NAM indicator (see F.3 of [1, 1]). RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set these bits to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

27 28

3.5.2.4 IMSI_T Parameter Block The PARAM_DATA field of the IMSI_T Parameter Block consists of the following fields:

29

Field IMSI_T_CLASS IMSI_T_ADDR_NUM MCC_T IMSI_T_11_12 IMSI_T_S RESERVED

30

Length (bits) 1 3 10 7 34 1

IMSI_T_CLASS

IMSI_T Class assignment of the mobile station.

3-97

3GPP2 C.S0016-D v2.0 If the mobile stations IMSI_T is a class 0 IMSI, the mobile station shall set this field to 0; otherwise, the mobile station shall set this field to 1. IMSI_T_ADDR_NUM Number of IMSI_T address digits. If the mobile station has been assigned a class 1 IMSI_T (see 6.3.1 of [1] or 2.3.1 of [1]), the mobile station shall set this field to four less than the number of digits in the NMSI; otherwise, the mobile station shall set this field to 000. MCC_T Mobile country code. The mobile station shall set this field to the value of the MCC_Tp NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]). IMSI__T_11_12 11th and 12th digits of the IMSI_T. The mobile station shall set this field to the value of the IMSI_T_11_12p NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]). IMSI_T_S The least significant 10 digits of the IMSI_T. The mobile station shall set this field to the value of the IMSI_T_Sp NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]). RESERVED Reserved bits. The mobile station shall set this field to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

24 25

3.5.2.5 eHRPD IMSI Parameter Block The PARAM_DATA field of the eHRPD IMSI Parameter Block consists of the following fields:

26

Field eHRPD_MNC_NUM_DIGITS eHRPD_IMSI_NUM_DIGITS RESERVED eHRPD_IMSI_DIGITS RESERVED

27 28 29 30 31 32

Length (bits) 1 4 3 4 * eHRPD_IMSI_NUM_DIGITS 0 to 4 bits as needed

eHRPD_MNC_NUM_DIGITS - Number of Mobile Network Code Digits. If the number of MNC digits in the eHRPD IMSI is 2, the value of this field is set to 0. Otherwise, it is set to 1 to indicate an MNC with 3 digits in the eHRPD IMSI. eHRPD_IMSI_NUM_DIGITS - Number of eHRPD International Mobile Station Identity Digits

3-98

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the number of digits in eHRPD_IMSI. RESERVED eHRPD_IMSI_DIGITS Reserved bits. The mobile station shall set this field to 000. eHRPD International Mobile Station Identity Digits The mobile station shall set this field to the eHRPD IMSI using BCD encoding wherein each digit is represented by 4 bits. Digits are included in sequence starting with the most significant digit.3 RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

16 17 18 19 20

3.5.3 SSPR Parameter Blocks Table 3.5.3-1 lists the types of parameter blocks used in the SSPR Configuration Request Message and the SSPR Configuration Response Message.

Table 3.5.3-1

SSPR Parameter Block Types BLOCK_ID 00000000 00000001 00000010 00000011 01111111 1000000011111110 11111111 See [4] Reference 3.5.3.1 3.5.3.2 3.5.3.3

SSPR Parameter Block Type Preferred Roaming List Dimensions Preferred Roaming List Extended Preferred Roaming List Dimensions Reserved for future standardization Available for manufacturer-specific parameter block definitions Reserved
21

3 For example, given the eHRPD IMSI 001 02 0123456789, eHRPD_MNC_NUM_DIGITS is 0,

eHRPD_IMSI_NUM_DIGITS is 1111, and eHRPD_IMSI_DIGITS is 0000 0000 0001 0000 0010 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 where spaces between digits and bits have been added for clarity.

3-99

3GPP2 C.S0016-D v2.0 3.5.3.1 Preferred Roaming List Dimensions Parameter Block The PARAM_DATA field of the Preferred Roaming List Dimensions Parameter Block consists of the following fields: Field MAX_PR_LIST_SIZE CUR_PR_LIST_SIZE PR_LIST_ID RESERVED NUM_ACQ_RECS NUM_SYS_RECS
5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

1 2 3 4

Length (bits) 16 16 16 1 9 14

MAX_PR_LIST_SIZE

Maximum preferred roaming list size. The mobile station shall set this field to the maximum size, in octets, that the mobile station can support for the preferred roaming list (PR_LISTs-p).

CUR_PR_LIST_SIZE

Current preferred roaming list size. The mobile station shall set this field to the size, in octets, of the current preferred roaming list.

PR_LIST_ID

Preferred Roaming List Identification. The mobile station shall set this field to the value of the Preferred Roaming List Identification assigned for the preferred roaming list (PR_LISTs-p) by the base station.

RESERVED NUM_ACQ_RECS

Reserved bit. The mobile station shall set this field to 0. Number of acquisition records. The mobile station shall set this field to the number of acquisition records contained in the ACQ_TABLE field of the current preferred roaming list.

NUM_SYS_RECS

Number of system records. The mobile station shall set this field to the number of system records contained in the SYS_TABLE field of the current preferred roaming list.

3-100

3GPP2 C.S0016-D v2.0 3.5.3.2 Preferred Roaming List Parameter Block The PARAM_DATA field of the Preferred Roaming List Parameter Block consists of the following fields: Field RESERVED LAST_SEGMENT SEGMENT_OFFSET SEGMENT_SIZE SEGMENT_DATA
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

1 2 3

Length (bits) 7 1 16 8 8 SEGMENT_SIZE

RESERVED LAST_SEGMENT

Reserved bits. The mobile station shall set this field to 0000000. Last segment indicator bit. The mobile station shall set this field to 1 if SEGMENT_DATA contains the last octet of the preferred roaming list (PR_LISTsp); otherwise, the mobile station shall set this field to 0.

SEGMENT_OFFSET

Segment offset. The mobile station shall set this field to the value of REQUEST_OFFSET from the corresponding SSPR Configuration Request Message.

SEGMENT_SIZE

Segment size. The mobile station shall set this field to the number of octets of the preferred roaming list (PR_LISTs-p) included in SEGMENT_DATA. If REQUEST_OFFSET from the corresponding SSPR Configuration Request Message specifies an offset that is invalid for the current preferred roaming list, the mobile station shall set this field to zero. If REQUEST_OFFSET specifies an offset that is valid for the current preferred roaming list, the mobile station shall set this field to a value less than or equal to REQUEST_MAX_SIZE.

SEGMENT_DATA

Segment of the preferred roaming list (PR_LISTs-p) data. If REQUEST_OFFSET from the corresponding SSPR Configuration Request Message specifies an offset that is invalid for the current preferred roaming list, the mobile station shall include no octets in this field.

3-101

3GPP2 C.S0016-D v2.0 If REQUEST_OFFSET specifies an offset that is valid for the current preferred roaming list, the mobile station shall include at most REQUEST_MAX_SIZE sequential octets of the preferred roaming list in this field. This field contains SEGMENT_SIZEThe octets shall be equal to the octets starting at the offset specified by SEGMENT_OFFSET within the preferred roaming list specified by SEGMENT_OFFSET.

1 2 3 4 5 6 7 8 9

3-102

3GPP2 C.S0016-D v2.0

1 2 3 4

3.5.3.3 Extended Preferred Roaming List Dimensions Parameter Block The PARAM_DATA field of the Extended Preferred Roaming List Dimensions Parameter Block consists of the following fields: Field MAX_PR_LIST_SIZE CUR_PR_LIST_SIZE PR_LIST_ID CUR_SSPR_P_REV CUR_SSPR_P_REV-specific fields 16 16 16 8 variable Length (bits)

If CUR_SSPR_P_REV is 00000001 the CUR_SSPR_P_REVspecific fields also include the following fields: RESERVED NUM_ACQ_RECS NUM_SYS_RECS 1 9 14

If CUR_SSPR_P_REV is 00000011 the CUR_SSPR_P_REVspecific fields also include the following fields: NUM_ACQ_RECS NUM_COMMON_SUBNET_RECS NUM_EXT_SYS_RECS
5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

9 9 14

MAX_PR_LIST_SIZE

Maximum preferred roaming list size. The mobile station shall set this field to the maximum size, in octets, that the mobile station can support for the preferred roaming list (PR_LISTs-p).

CUR_PR_LIST_SIZE

Current preferred roaming list size. The mobile station shall set this field to the size, in octets, of the current preferred roaming list.

PR_LIST_ID

Preferred Roaming List Identification. The mobile station shall set this field to the value of the Preferred Roaming List Identification assigned for the preferred roaming list (PR_LISTs-p) by the base station.

CUR_SSPR_P_REV

Protocol revision of the mobile stations current preferred roaming list. The mobile station shall set this field to the value of the SSPR_P_REV associated with its current preferred roaming list.

3-103

3GPP2 C.S0016-D v2.0 RESERVED NUM_ACQ_RECS Reserved bit. The mobile station shall set this field to 0. Number of acquisition records. The mobile station shall set this field to the number of acquisition records contained in the ACQ_TABLE field of the current preferred roaming list. NUM_SYS_RECS Number of system records. The mobile station shall set this field to the number of system records contained in the SYS_TABLE field of the current preferred roaming list. NUM_COMMON_SUBNET_RECS Number of records in the Common Subnet Table. This field is set to the number of records contained in the Common Subnet Table. NUM_EXT_SYS_RECS Number of extended system records. The mobile station shall set this field to the number of extended system records contained in the EXT_SYS_TABLE field of the current preferred roaming list.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

20 21 22

3.5.4 Reserved Reserved.

23 24 25 26 27 28 29 30 31 32

3.5.5 Preferred Roaming List and Extended Preferred Roaming List The preferred roaming list (PR_LISTs-p) contains information to assist the mobile station system selection and acquisition process, particularly when the mobile station is roaming. The preferred roaming list can be sent to the mobile station using Over-the-Air Service Provisioning (OTASP). The preferred roaming list is retained by the mobile station when power is turned off. Two categories of the preferred roaming list are defined: The Preferred Roaming List and the Extended Preferred Roaming List. The Preferred Roaming List is associated with SSPR_P_REV equal to 00000001 and has the following variable length format:

3-104

3GPP2 C.S0016-D v2.0

Preferred Roaming List Field PR_LIST_SIZE PR_LIST_ID PREF_ONLY DEF_ROAM_IND NUM_ACQ_RECS NUM_SYS_RECS ACQ_TABLE SYS_TABLE RESERVED PR_LIST_CRC
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Length (bits) 16 16 1 8 9 14 variable variable 0 to 7 16

PR_LIST_SIZE

Preferred roaming list size. This field is set to the total size, in octets, of the preferred roaming list, including the PR_LIST_SIZE and PR_LIST_CRC fields.

PR_LIST_ID

Preferred Roaming List Identification. The mobile station shall set this field to the value of the Preferred Roaming List Identification assigned for the preferred roaming list (PR_LISTs-p) by the base station.

PREF_ONLY

Preferred only. This field is set to 1 if the mobile station is to operate only on systems that are specified in SYS_TABLE with PREF_NEG set to 1. This field is set to 0 if the mobile station is to operate on systems that are specified in SYS_TABLE with PREF_NEG set to 1 or on systems that are not specified in SYS_TABLE4.

DEF_ROAM_IND

Default roaming indication. This field is set to the roaming indication value the mobile station is to use when operating on systems not specified in SYS_TABLE (see [4]).

NUM_ACQ_RECS

Number of acquisition records. This field is set to the number of acquisition records contained in ACQ_TABLE (see Table 3.5.5.2-1).

NUM_SYS_RECS

Number of system records.

4 For emergency access (911) the mobile station may ignore restrictions

set by the PREF_ONLY and

PREF_NEG fields and access any available system.

3-105

3GPP2 C.S0016-D v2.0 This field is set to the number of system records contained in SYS_TABLE. ACQ_TABLE Acquisition Table. This field contains the Acquisition Records. The number of acquisition records is specified by NUM_ACQ_RECS. The acquisition record formats are specified in 3.5.5.2.1. SYS_TABLE System Table. This field contains system records. The number of system records is specified by NUM_SYS_RECS. The system record format is specified in 3.5.5.3.1. RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0' PR_LIST_CRC CRC for preferred roaming list. This field is set to the 16-bit CRC calculated according to 3.5.5.1.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

The Extended Preferred Roaming List is associated with SSPR_P_REV greater than or equal to 00000010 and has the following variable length format: Extended Preferred Roaming List Field PR_LIST_SIZE PR_LIST_ID CUR_SSPR_P_REV CUR_SSPR_P_REV-specific 16 16 8 variable Length (bits)

22 23 24 25 26 27 28 29 30 31 32

PR_LIST_SIZE

Extended Preferred Roaming List size. This field is set to the total size, in octets, of the Extended Preferred Roaming List, including the PR_LIST_SIZE and PR_LIST_CRC fields.

PR_LIST_ID

Preferred Roaming List Identification. The mobile station shall set this field to the value of the Extended Preferred Roaming List identification assigned for the preferred roaming list (PR_LISTs-p) by the base station.

CUR_SSPR_P_REV

Protocol revision for the PRL format. This field is used to specify the format of the rest of the Extended Preferred Roaming List.

3-106

3GPP2 C.S0016-D v2.0 The format of the Extended Preferred Roaming List associated with the SSPR_P_REV equal to 00000011 has the following format: Extended Preferred Roaming List Field PR_LIST_SIZE PR_LIST_ID CUR_SSPR_P_REV PREF_ONLY DEF_ROAM_IND NUM_ACQ_RECS NUM_COMMON_SUBNET_RECS NUM_SYS_RECS RESERVED EXT_ACQ_TABLE COMMON_SUBNET_TABLE EXT_SYS_TABLE RESERVED PR_LIST_CRC
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

1 2 3

Length (bits) 16 16 8 1 8 9 9 14 7 variable variable variable As needed 16

PR_LIST_SIZE

Preferred roaming list size. This field is set to the total size, in octets, of the preferred roaming list, including the PR_LIST_SIZE and PR_LIST_CRC fields.

PR_LIST_ID

Preferred Roaming List Identification. The mobile station shall set this field to the value of the Preferred Roaming List Identification assigned for the preferred roaming list (PR_LISTs-p) by the base station.

CUR_SSPR_P_REV

Protocol revision of the mobile station SSPR Download procedure and the PRL format. This field is set to the value of the SSPR_P_REV corresponding this preferred roaming list (PR_LISTs-p) structure. This field determines the parsing rules for the Preferred Roaming List. The mobile station shall set this field to 00000011 for this PRL structure.

PREF_ONLY

Preferred only.

3-107

3GPP2 C.S0016-D v2.0 This field is set to 1 if the mobile station is to operate only on systems that are specified in SYS_TABLE with PREF_NEG set to 1. This field is set to 0 if the mobile station is to operate on systems that are specified in SYS_TABLE with PREF_NEG set to 1 or on systems that are not specified in SYS_TABLE5. DEF_ROAM_IND Default roaming indication. This field is set to the roaming indication value the mobile station is to use when operating on systems not specified in SYS_TABLE (see [4]TSB58). NUM_ACQ_RECS Number of acquisition records. This field is set to the number of acquisition records contained in ACQ_TABLE (see Table 3.5.5.2-1). NUM_COMMON_SUBNET_RECS Number of records in the Common Subnet Table. This field is set to the number of records contained in the Common Subnet Table. NUM_SYS_RECS Number of system records. This field is set to the number of Extended System Records contained in EXT_SYS_TABLE. RESERVED EXT_ACQ_TABLE Reserved bits. The mobile station shall set this field to 0000000. Extended Acquisition Table. This field contains the Extended Acquisition Records. The number of acquisition records is specified by NUM_ACQ_RECS. The Extended Acquisition Record format is specified in 3.5.5.2.2. COMMON_SUBNET_TABLE Common Subnet Table. This field contains the Common Subnet Records defined in 3.5.5.3.2.1. The number of Common Subnetacquisition records is specified by NUM_COMMON_SUBNET_RECS. EXT_SYS_TABLE Extended System Table. This field contains Extended System Records. The number of Extended system records is specified by NUM_SYS_RECS. The Extended system record format is specified in 3.5.5.3.2. RESERVED Reserved bits.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36

5 For emergency access (911) the mobile station may ignore restrictions set by the PREF_ONLY and

PREF_NEG fields and access any available system.

3-108

3GPP2 C.S0016-D v2.0 This field is populated with 0 bits as necessary to make the length of the entire preferred roaming list equal to an integer number of octets. This field may be extended for future use. The mobile station shall be able to parse the entire Extended PRL even if this field is more than 7 bits. PR_LIST_CRC CRC for preferred roaming list. This field is set to the 16-bit CRC calculated according to 3.5.5.1.

1 2 3 4 5 6 7 8 9

10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

3.5.5.1 Preferred Roaming List CRC Calculation The 16-bit preferred roaming list CRC field PR_LIST_CRC is calculated on all bits of the Preferred Roaming List/Extended Preferred Roaming List excluding the bits of the PR_LIST_CRC field itself. The generator polynomial for this CRC is 16 12 5 0 g(x) = x +x +x +x . The 16-bit CRC is calculated according to the following procedure using the logic shown in Figure 2.2.1-2: Initially, all shift register elements are set to logical one and the switches are set in the position A. The register is clocked with each preferred roaming list bit as an input, from the most significant bit of the PR_LIST_SIZE field through the least significant bit of the RESERVED field. The switches are set in the position B, and the register is clocked an additional 16 times. The 16 additional output bits constitute the CRC.

25 26 27 28 29 30 31 32 33

3.5.5.2 Acquisition Records An acquisition record contains parameters that the mobile station can use to acquire a system. Each type of acquisition record is tailored for use in acquiring a particular kind of system. Two categories of acquisition records are defined; Acquisition Records and Extended Acquisition Records. Table 3.5.5.2-1 defines the types of Acquisition Records. The Acquisition Records shall be used only in a Preferred Roaming List associated with the SSPR_P_REV equal to 00000001.

3-109

3GPP2 C.S0016-D v2.0 Table 3.5.5.2-1 Acquisition Record Type Values Acquisition Record Type Reserved Cellular Analog Cellular CDMA (Standard Channels) Cellular CDMA (Custom Channels) Cellular CDMA Preferred PCS CDMA (Using Blocks) PCS CDMA (Using Channels) JTACS CDMA (Standard Channels) JTACS CDMA (Custom Channels) 2GHz Band (Using Channels) Reserved
2 3 4 5

Value 0000 0001 0010 0011 0100 0101 0110 '0111' '1000' '1001' 1010 - 1111

Table 3.5.5.2-2 defines the types of Extended Acquisition Records. The Extended Acquisition Records shall be used only in an Extended Preferred Roaming List associated with the SSPR_P_REV equal to 00000011.

3-110

3GPP2 C.S0016-D v2.0 Table 3.5.5.2-2 Extended Acquisition Record Type Values Acquisition Record Type Reserved Cellular Analog Cellular CDMA (Standard Channels) Cellular CDMA (Custom Channels) Cellular CDMA Preferred PCS CDMA (Using Blocks) PCS CDMA (Using Channels) JTACS CDMA (Standard Channels) JTACS CDMA (Custom Channels) 2GHz Band (Using Channels) Generic Acquisition Record for cdma2000 1x and IS-95 Generic Acquisition Record for HRPD Reserved for Obsolete Identification Common Acquisition table record for UMB Generic acquisition record for UMB Reserved
2 3 4 5 6

Value 00000000 00000001 00000010 00000011 00000100 00000101 00000110 '00000111' '00001000' '00001001' 00001010 00001011 00001100- 00001110 00001111 00010000 All other values

If ACQ_TABLE contains more than one acquisition record, these records should be listed in priority order (highest priority first) according to the desired mobile station system selection scanning priorities.

3.5.5.2.1 Acquisition Record Formats 3.5.5.2.1.1 Cellular Analog System Acquisition Record This acquisition record type is for use in acquiring a cellular analog system, and has the following fixed length format: Acquisition Record Field ACQ_TYPE (0001) A_B 4 2 Length (bits)

8 9 10 11

12 13

ACQ_TYPE

Acquisition record type.

3-111

3GPP2 C.S0016-D v2.0 This field is set to 0001 (see Table 3.5.5.2-1). A_B System A/B selection type. The values for this field are specified in Table 3.5.5.2.1.1-1.

1 2 3 4 5

Table 3.5.5.2.1.1-1 Cellular System A/B Selection Type Values System A/B Selection Type System A System B Reserved System A or B 00 01 10 11 Value

7 8 9 10 11 12

3.5.5.2.1.2 Cellular CDMA and JTACS CDMA System Acquisition (Standard Channels) Record This acquisition record type is for use in acquiring a cellular CDMA and JTACS CDMA system on the primary or secondary CDMA channels, and has the following fixed length format: Acquisition Record Field ACQ_TYPE (0010) A_B PRI_SEC 4 2 2 Length (bits)

13 14 15 16 17 18 19 20

ACQ_TYPE A_B PRI_SEC

Acquisition record type. This field is set to 0010 (see Table 3.5.5.2-1). System A/B selection type. The values for this field are specified in Table 3.5.5.2.1.1-1. Standard CDMA Channel selection type. The values for this field are specified in Table 3.5.5.2.1.2-1.

3-112

3GPP2 C.S0016-D v2.0 Table 3.5.5.2.1.2-1 Cellular CDMA and JTACS CDMA Standard Channel Selection Type Values Standard Channel Selection Type Reserved Primary CDMA Channel Secondary CDMA Channel Primary or Secondary CDMA Channel
3

1 2

Value 00 01 10 11

4 5 6 7 8

3.5.5.2.1.3 Cellular CDMA and JTACS CDMA System Acquisition (Custom Channels) Record This acquisition record type is for use in acquiring a cellular CDMA and JTACS CDMA system using a list of CDMA channels, and has the following variable length format: Acquisition Record Field ACQ_TYPE (0011) NUM_CHANS 4 5 Length (bits)

NUM_CHANS occurrences of the following field: CHAN

9 10 11 12 13 14 15 16 17 18 19 20 21

11

ACQ_TYPE NUM_CHANS

Acquisition record type. This field is set to 0011 (see Table 3.5.5.2-1). Number of CDMA channels. This field is set to the number of cellular CDMA and JTACS CDMA channels included in this record.

CHAN

Cellular CDMA and JTACS CDMA channel. This field specifies a cellular CDMA and JTACS CDMA channel number (see 6.1.1.1 of [1] or [23]). The CHAN fields should be listed in priority order (highest priority first) according to the desired mobile station system selection scanning priorities.

3-113

3GPP2 C.S0016-D v2.0 3.5.5.2.1.4 Cellular CDMA Preferred System Acquisition Record This acquisition record type is for use in acquiring a cellular system (CDMA first, then Analog), and has the following fixed length format: Acquisition Record Field ACQ_TYPE (0100) A_B
4 5 6 7 8 9

1 2 3

Length (bits) 4 2

ACQ_TYPE A_B

Acquisition record type. This field is set to 0100 (see Table 3.5.5.2-1). System A/B selection type. The values for this field are specified in Table 3.5.5.2.1.1-1.

10 11 12 13

3.5.5.2.1.5 PCS CDMA System Acquisition (Using Blocks) Record This acquisition record type is for use in acquiring a PCS CDMA system using a list of CDMA frequency blocks, and has the following variable length format: Acquisition Record Field ACQ_TYPE (0101) NUM_BLOCKS 4 3 Length (bits)

NUM_BLOCKS occurrences of the following field: BLOCK

14 15 16 17 18 19 20 21 22 23 24 25

ACQ_TYPE NUM_BLOCKS

Acquisition record type. This field is set to 0101 (see Table 3.5.5.2-1). Number of frequency blocks. This field is set to the number of PCS frequency blocks included in this record.

BLOCK

PCS frequency block. The values for this field are specified in Table 3.5.5.2.1.5-1. The BLOCK fields should be listed in priority order (highest priority first) according to the desired mobile station system selection scanning priorities.

3-114

3GPP2 C.S0016-D v2.0 Table 3.5.5.2.1.5-1 PCS CDMA Frequency Blocks PCS CDMA Frequency Block Block A Block B Block C Block D Block E Block F Reserved Any Block
2

Value 000 001 010 011 100 101 110 111

3 4 5 6 7

3.5.5.2.1.6 PCS CDMA and 2 GHz Band CDMA System Acquisition (Using Channels) Record This acquisition record type is for use in acquiring a PCS CDMA and a 2 GHz Band CDMA system using a list of CDMA channels, and has the following variable length format: Acquisition Record Field ACQ_TYPE (0110) NUM_CHANS 4 5 Length (bits)

NUM_CHANS occurrences of the following field: CHAN

8 9 10 11 12 13 14 15 16 17 18 19

11

ACQ_TYPE NUM_CHANS

Acquisition record type. This field is set to 0110 (see Table 3.5.5.2-1). Number of CDMA channels. This field is set to the number of PCS CDMA and 2 GHz band CDMA channels included in this record.

CHAN

PCS CDMA channel. This field specifies a PCS CDMA and a 2 GHz Band CDMA channel number (see 6.1.1.1 of [1] or [23]). The CHAN fields should be listed in priority order (highest priority first) according to the desired mobile station system selection scanning priorities.

3-115

3GPP2 C.S0016-D v2.0 3.5.5.2.1.7 JTACS CDMA System Acquisition (Standard Channels) Record This acquisition record type is for use in acquiring a JTACS CDMA system on the primary or secondary CDMA channels, and has the following fixed length format: Acquisition Record Field ACQ_TYPE (0111) A_B PRI_SEC
5 6 7 8 9 10 11 12 13

1 2 3 4

Length (bits) 4 2 2

ACQ_TYPE A_B PRI_SEC

Acquisition record type. This field is set to 0111 (see Table 3.5.5.2-1).

- System A/B selection type. The values for this field are specified in Table 3.5.5.2.1.1-1. Standard CDMA Channel selection type. The values for this field are specified in Table 3.5.5.2.1.7-1.

Table 3.5.5.2.1.7-1 JTACS CDMA Standard Channel Selection Type Values Standard Channel Selection Type Reserved Primary CDMA Channel Secondary CDMA Channel Primary or Secondary CDMA Channel 00 01 10 11 Value

14

15 16 17 18

3.5.5.2.1.8 JTACS CDMA System Acquisition (Custom Channels) Record This acquisition record type is for use in acquiring a JTACS CDMA system using a list of custom CDMA channels, and has the following variable length format: Acquisition Record Field ACQ_TYPE (1000) NUM_CHANS 4 5 Length (bits)

NUM_CHANS occurrences of the following field: CHAN 11

3-116

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10 11 12

ACQ_TYPE NUM_CHANS

Acquisition record type. This field is set to 1000 (see Table 3.5.5.2-1). Number of CDMA channels. This field is set to the number of JTACS CDMA channels included in this record.

CHAN

JTACS CDMA channel. This field specifies a JTACS CDMA channel number [23]. The CHAN fields should be listed in priority order (highest priority first) according to the desired mobile station system selection scanning priorities.

13 14 15 16

3.5.5.2.1.9 2 GHz Band CDMA System Acquisition (Using Channels) Record This acquisition record type is for use in acquiring a 2 GHz Band CDMA system using a list of CDMA channels, and has the following variable length format: Acquisition Record Field ACQ_TYPE (1001) NUM_CHANS 4 5 Length (bits)

NUM_CHANS occurrences of the following field: CHAN

17 18 19 20 21 22 23 24 25 26 27

11

ACQ_TYPE NUM_CHANS

Acquisition record type. This field is set to 1001 (see Table 3.5.5.2-1). Number of CDMA channels. This field is set to the number of 2 GHz Band CDMA channels included in this record.

CHAN

2 GHz Band CDMA channel. This field specifies a PCS CDMA channel number (see [23]). The CHAN fields should be listed in priority order (highest priority first) according to the desired mobile station system selection scanning priorities.

3-117

3GPP2 C.S0016-D v2.0 3.5.5.2.2 Extended Acquisition Record Format The format of the Extended Acquisition Record is as follows: Type-specific Record ACQ_TYPE LENGTH Type-specific
4 5 6 7 8 9 10 11

1 2 3

Length (bits) 8 8 8 LENGTH

ACQ_TYPE

Acquisition record type. This field is set to the Extended Acquisition Record type (see Table 3.5.5.2-2) and identifies the type-specific fields.

LENGTH

Length of the Type-specific fields. This field is set to the length of the Type-specific record in octets.

The contents of the type-specific fields determined by the ACQ_TYPE field and are specified as follows. 3.5.5.2.2.1 Cellular Analog System Acquisition Record If the ACQ_TYPE field is set to 00000001, the type-specific record specifies the acquisition record for use in acquiring a cellular analog system. The type-specific record has the following fixed-length format: Type-specific Record A_B RESERVED 2 6 Length (bits)

12 13 14 15 16

17 18 19 20 21

A_B RESERVED

System A/B selection type. The values for this field are specified in Table 3.5.5.2.1.1-1. Reserved bit. The mobile station shall set this field to 000000.

3-118

3GPP2 C.S0016-D v2.0

2 3 4 5 6

3.5.5.2.2.2 Cellular CDMA System Acquisition (Standard Channels) Record If the ACQ_TYPE field is set to 00000010, the type-specific record specifies the acquisition record for use in acquiring a cellular CDMA system on the primary or secondary CDMA channels. The type-specific record has the following fixed-length format: Type-specific Record A_B PRI_SEC RESERVED 2 2 4 Length (bits)

7 8 9 10 11 12 13 14

A_B PRI_SEC RESERVED

System A/B selection type. The values for this field are specified in Table 3.5.5.2.1.1-1. Standard CDMA Channel selection type. The values for this field are specified in Table 3.5.5.2.1.2-1. Reserved bit. The mobile station shall set this field to 0000.

15 16 17 18 19

3.5.5.2.2.3 Cellular CDMA System Acquisition (Custom Channels) Record If the ACQ_TYPE field is set to 00000011, the type-specific record specifies the acquisition record for use in acquiring a cellular CDMA system using a list of CDMA channels. The type-specific record has the following variable-length format: Type-specific Record NUM_CHANS 5 Length (bits)

NUM_CHANS occurrences of the following field: CHAN 11

RESERVED
20 21 22 23 24

0 to 7

NUM_CHANS

Number of CDMA channels. This field is set to the number of cellular CDMA channels included in this record.

CHAN

Cellular CDMA channel.

3-119

3GPP2 C.S0016-D v2.0 This field specifies a cellular CDMA channel number (see 6.1.1.1 of [1] or [23]). The CHAN fields should be listed in priority order (highest priority first) according to the desired mobile station system selection scanning priorities. RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

1 2 3 4 5 6 7 8 9

10 11 12 13 14

3.5.5.2.2.4 Cellular CDMA Preferred System Acquisition Record If the ACQ_TYPE field is set to 00000100, the type-specific record specifies the acquisition record for use in acquiring a cellular system (CDMA first, then Analog). The type-specific record has the following fixed-length format: Type-specific Record A_B RESERVED 2 6 Length (bits)

15 16 17 18 19 20

A_B RESERVED

System A/B selection type. The values for this field are specified in Table 3.5.5.2.1.1-1. Reserved bit. The mobile station shall set this field to 000000.

21 22 23 24 25

3.5.5.2.2.5 PCS CDMA System Acquisition (Using Blocks) Record If the ACQ_TYPE field is set to 00000101, the type-specific record specifies the acquisition record for use in acquiring a PCS CDMA system using a list of CDMA frequency blocks. The type-specific record has the following variable-length format: Type-specific Record NUM_BLOCKS 3 Length (bits)

NUM_BLOCKS occurrences of the following field: BLOCK 3

RESERVED
26 27

0 to 7

NUM_BLOCKS

Number of frequency blocks.

3-120

3GPP2 C.S0016-D v2.0 This field is set to the number of PCS frequency blocks included in this record. BLOCK PCS frequency block. The values for this field are specified in Table 3.5.5.2.1.5-1. The BLOCK fields should be listed in priority order (highest priority first) according to the desired mobile station system selection scanning priorities. RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

1 2 3 4 5 6 7 8 9 10 11 12

13 14 15 16 17

3.5.5.2.2.6 PCS CDMA System Acquisition (Using Channels) Record If the ACQ_TYPE field is set to 00000110, the type-specific record specifies the acquisition record for use in acquiring a PCS CDMA system using a list of CDMA channels. The typespecific record has the following variable-length format: Type-specific Record NUM_CHANS 5 Length (bits)

NUM_CHANS occurrences of the following field: CHAN 11

RESERVED
18 19 20 21 22 23 24 25 26 27 28 29 30

0 to 7

NUM_CHANS

Number of CDMA channels. This field is set to the number of PCS CDMA channels included in this record.

CHAN

PCS CDMA channel. This field specifies a PCS CDMA channel number (see 6.1.1.1 of [1] or [23]). The CHAN fields should be listed in priority order (highest priority first) according to the desired mobile station system selection scanning priorities.

RESERVED

Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

3-121

3GPP2 C.S0016-D v2.0 3.5.5.2.2.7 JTACS CDMA System Acquisition (Standard Channels) Record If the ACQ_TYPE field is set to 00000111, the type-specific record specifies the acquisition record for use in acquiring a JTACS CDMA system on the primary or secondary CDMA channels. The type-specific record has the following fixed-length format: Type-specific Record A_B PRI_SEC RESERVED
6 7 8 9 10 11 12

1 2 3 4 5

Length (bits) 2 2 4

A_B PRI_SEC RESERVED

System A/B selection type. The values for this field are specified in Table 3.5.5.2.1.1-1. Standard CDMA Channel selection type. Reserved bit. The mobile station shall set this field to 0000.

The values for this field are specified in Table 3.5.5.2.1.7-1.

13 14 15 16 17

3.5.5.2.2.8 JTACS CDMA System Acquisition (Custom Channels) Record If the ACQ_TYPE field is set to 00001000, the type-specific record specifies the acquisition record for use in acquiring a JTACS CDMA system using a list of custom CDMA channels. The type-specific record has the following variable-length format: Type-specific Record NUM_CHANS 5 Length (bits)

NUM_CHANS occurrences of the following field: CHAN 11

RESERVED
18 19 20 21 22

0 to 7

NUM_CHANS

Number of CDMA channels. This field is set to the number of JTACS CDMA channels included in this record.

CHAN

JTACS CDMA channel.

3-122

3GPP2 C.S0016-D v2.0 This field specifies a JTACS CDMA channel number [23]. The CHAN fields should be listed in priority order (highest priority first) according to the desired mobile station system selection scanning priorities. RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'. 3.5.5.2.2.9 2 GHz Band CDMA System Acquisition (Using Channels) Record If the ACQ_TYPE field is set to 00001001, the type-specific record specifies the acquisition record for use in acquiring a 2 GHz Band CDMA system using a list of CDMA channels. The type-specific record has the following variable-length format: This acquisition record type is for use in acquiring, and has the following variable length format: Type-specific Record NUM_CHANS 5 Length (bits)

1 2 3 4 5 6 7 8

9 10 11 12 13 14 15

NUM_CHANS occurrences of the following field: CHAN 11

RESERVED
16 17 18 19 20 21 22 23 24 25 26 27 28

0 to 7

NUM_CHANS

Number of CDMA channels. This field is set to the number of 2 GHz Band CDMA channels included in this record.

CHAN

2 GHz Band CDMA channel. This field specifies a PCS CDMA channel number (see [23]). The CHAN fields should be listed in priority order (highest priority first) according to the desired mobile station system selection scanning priorities.

RESERVED

Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

29 30 31 32

3.5.5.2.2.10 Generic Acquisition Record for cdma2000 1x and IS-95 If the ACQ_TYPE field is set to 00001010, the type-specific record specifies the acquisition record for use in acquiring cdma2000 1x and IS-95 systems using band-class and channel number [23]. The type-specific record has the following variable-length format:

3-123

3GPP2 C.S0016-D v2.0 This acquisition record type is for use in acquiring, and has the following variable length format: Type-specific Record Length (bits)

1 2 3

LENGTH/2 occurrences of the following two fields: BAND_CLASS CHANNEL_NUMBER

4 5 6 7 8

5 11

BAND_CLASS

This field is set to the Band Class number corresponding to the frequency assignment of the channel specified by this record. This field is set to the channel number corresponding to the Band Class specified by this record.

CHANNEL_NUMBER

9 10 11 12 13 14 15

3.5.5.2.2.11 Generic Acquisition Record for HRPD If the ACQ_TYPE field is set to 00001011, the type-specific record specifies the acquisition record for use in acquiring HRPD systems using band-class and channel number. The type-specific record has the following variable-length format: This acquisition record type is for use in acquiring, and has the following variable length format: Type-specific Record Length (bits)

LENGTH/2 occurrences of the following two fields: BAND_CLASS CHANNEL_NUMBER

16 17 18 19 20

5 11

BAND_CLASS

This field is set to the Band Class number corresponding to the frequency assignment of the channel specified by this record. This field is set to the channel number corresponding to the Band Class specified by this record.

CHANNEL_NUMBER

21 22 23 24

3.5.5.2.2.12 Reserved for Obsolete Identification Record Types A base station should not set the ACQ_TYPE field to 00001100, 00001101, or 00001110. A mobile station that receives an acquisition record with the ACQ_TYPE field set to 00001100, 00001101, or 00001110 should ignore the acquisition record. 3.5.5.2.2.13 Common Acquisition Table Record for UMB If the ACQ_TYPE field is set to 00001111, the type-specific record specifies the Common Acquisition Table Record for UMB that is referenced by a Generic Acquisition Record for UMB. Only one Common Acquisition Table Record for UMB, at most, shall be allowed. A Common Acquisition Table Record for UMB shall be required if there is a Generic

25 26 27 28 29

3-124

3GPP2 C.S0016-D v2.0 Acquisition Record for UMB with a UMB_ACQ_TABLE_PROFILE (see 3.5.5.2.2.13 Generic Acquisition Record for UMB) other than 111111. The type-specific record has the following variable-length format: Type-specific Record Length (bits)

1 2 3 4

LENGTH/2 occurrences of the following fields: UMB_ACQ_PROFILE FFT_SIZE CYCLIC_PREFIX_LENGTH NUM_GUARD_SUBCARRIERS RESERVED
5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

6 4 3 7 0 to 7

UMB_ACQ_PROFILE

UMB Acquisition Profile. This field is set to a unique 6-bit number that specifies a set of UMB acquisition fields (one FFT_SIZE field, one CYCLIC_PREFIX_LENGTH field and one NUM_GUARD_SUBCARRIERS field). UMB_ACQ_PROFILE is used by the Generic Acquisition Record for UMB for specifying the set of acquisition parameters. The value 111111 is reserved. The UMB_ACQ_PROFILE entries in the Common Acquisition Table Record for UMB should be listed in order of increasing UMB_ACQ_PROFILE values.

FFT_SIZE

Fast Fourier Transform Size. This field shall be set to log2(N_FFT/128), where N_FFT is the FFT size used by the UMB system [27]. The value 1111 denotes any FFT_SIZE (i.e. serves as a wildcard for FFT_SIZE).

CYCLIC_PREFIX_LENGTH This field shall be set to one less than the NCP parameter defined in the UMB Physical Layer [27]. Note that the UMB Physical Layer defines cyclic prefix as NCPNFFTTCHIP/16 seconds long. The value 111 denotes any CYCLIC_PREFIX_LENGTH (i.e. serves as a wildcard for CYCLIC_PREFIX_LENGTH). NUM_GUARD_SUBCARRIERS Number of Guard Subcarriers This field shall be set to the number of guard subcarriers used in the UMB system [27], in units of 16.

3-125

3GPP2 C.S0016-D v2.0 The value 1111111 denotes any NUM_GUARD_SUBCARRIERS (i.e. serves as a wildcard for NUM_GUARD_SUBCARRIERS). RESERVED Reserved bits The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

1 2 3 4 5 6 7 8

9 10 11 12 13 14 15

3.5.5.2.2.14 Generic Acquisition Record for UMB If the ACQ_TYPE field is set to 00010000, the type-specific record specifies the acquisition record for use in acquiring a UMB system [27]. If the UMB_ACQ_TABLE_PROFILE (described below) is set to a value other than 111111, then the Generic Acquisition Record for UMB shall reference the Common Acquisition Table Record for UMB. The type-specific record has the following variable-length format: Type-specific Record NUM_UMB_BLOCKS 6 Length (bits)

NUM_UMB_BLOCKS occurrences of the following fields: BAND_CLASS CHANNEL_NUMBER UMB_ACQ_TABLE_PROFILE 8 16 6

RESERVED
16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

0 to 7

NUM_UMB_BLOCKS

Number of UMB Blocks. This field is set to the number of UMB blocks included in this record.

NUM_UMB_BLOCKS occurrences of the following four fields shall be included. The UMB block fields should be listed in priority order (highest priority first) according to the desired mobile station system selection scanning priorities.

BAND_CLASS

This field is set to the Band Class number corresponding to the frequency assignment of the channel specified by this record. This field is set to the channel number corresponding to the Band Class specified by this record. The value 0xFFFF0xffff denotes any CHANNEL_NUMBER (i.e. serves as a wildcard for CHANNEL_NUMBER).

CHANNEL_NUMBER

3-126

3GPP2 C.S0016-D v2.0 UMB_ACQ_TABLE_PROFILE UMB Acquisition Table Profile This field shall be set to the value of the UMB_ACQ_PROFILE in the Common Acquisition Record for the desired set of UMB acquisition fields in the Common Acquisition Table Record for UMB. The value 111111 indicates that the Common Acquisition Table Record for UMB can be ignored. RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

1 2 3 4 5 6 7 8 9 10 11 12 13

14 15 16 17 18 19 20 21 22

3.5.5.3 System Record and Extended System Record Format A system record contains parameters that the mobile station can use for identifying an acquired system, for determining whether an acquired system is the optimal system on which to operate and for determining the mobile stations roaming status. Two categories of system records are defined: System Records and Extended System Records. A System Record defined in section 3.5.5.3.1 shall be included only in a Preferred Roaming List associated with the SSPR_P_REV equal to 00000001. An Extended System Record defined in section 3.5.5.3.2 shall be included only in an Extended Preferred Roaming List associated with the SSPR_P_REV equal to or greater than 00000011. 3.5.5.3.1 System Record Format Each System Record has the following variable length format: System Record Field SID NID_INCL NID PREF_NEG GEO PRI ACQ_INDEX ROAM_IND 15 2 0 or 16 1 1 0 or 1 9 0 or 8 Length (bits)

23 24 25

26 27 28 29

SID

System identification. This field is set to the SID of the system associated with this record.

3-127

3GPP2 C.S0016-D v2.0 The value 000000000000000 denotes a system with any SID (i.e., serves as a SID wildcard) not specifically included elsewhere in SYS_TABLE, provided that the system is found on a channel or in a block specified in the acquisition record corresponding to ACQ_INDEX. Any other value of this field denotes a system with that specific SID found on any channel. NID_INCL NID included. This field is set to the value defined in Table 3.5.5.3-1. Table 3.5.5.3-1 NID_INCL Values NID_INCL Value 00 01 10 11
11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

1 2 3 4 5 6 7 8 9 10

Parameter Description NID not included. Assume NID value 1111111111111111 NID included NID not included. Assume NID value 0000000000000000 Reserved

NID

Network identification. If the NID_INCL field of this record is equal to 01, this field is included and is set to the NID of the network associated with this record; otherwise, this field is omitted. The value 1111111111111111 denotes any NID (i.e., serves as a NID wildcard). Not including the NID field is equivalent to including it and setting it to 1111111111111111. The value 0000000000000000 denotes a NID of the public system (see 6.6.5.2 of [1] or 2.6.5.2 of [1])

PREF_NEG

Preferred/negative system. This field is set to 1 if the mobile station is allowed to operate on the system associated with this record. This field is set to 0 if the mobile station is not allowed to operate on the system associated with this record.

GEO

Geographical region indicator. If this is the first system record, this field is set to 0. If this is not the first system record, then this field is set as follows: If the system associated with this record is in the same geographical region as the system associated with the previous system record, this field is set to 1; otherwise, this field is set to 0.

PRI

Relative priority indicator.

3-128

3GPP2 C.S0016-D v2.0 If the PREF_NEG field of this system record is equal to 0, this field is omitted; otherwise this field is included and is set as follows: If this is the last system record in the specific geographical region, or if the PREF_NEG field in the next system record is equal to0, this field is set to 0 and has no meaning. If the system associated with this system record is more desirable than the system associated with the next system record, this field is set to 1. If the system associated with this system record is as desirable as the system associated with the next system record, this field is set to 0. ACQ_INDEX Acquisition record index. This field is set to the index of the acquisition record that specifies the acquisition parameters for the system associated with this record. Note: The index of the nth acquisition record is n-1. For example, the index of the first acquisition record in ACQ_TABLE is 0, and the index for the fourth acquisition record is 3. ROAM_IND If the PREF_NEG field of this record is equal to 1, this field is included and is set to the roaming indication value (see [4]) for the system associated with this record; otherwise, this field is omitted.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

17 18 19 20 21 22 23 24

25 26 27

3.5.5.3.2 Extended System Record Format Each Extended System Record has the following variable length format: System Record Field SYS_RECORD_LENGTH SYS_RECORD_TYPE SYS_RECORD_TYPE specific fields 5 4 variable Length (bits)

28 29 30 31 32 33 34

SYS_RECORD_LENGTH -

Extended System Record Length. This field is set to the length of the Extended System Record in octets.

SYS_RECORD_TYPE

Extended System Record Type. The value of this field specifies the format of the rest of this record.

3-129

3GPP2 C.S0016-D v2.0 The following table specifies the format of the Extended System Record for the values of the SYS_RECORD_TYPE specified in Table 3.5.5.3.2-1. All other values for the SYS_RECORD_TYPE are reserved. System Record Field SYS_RECORD_LENGTH SYS_RECORD_TYPE PREF_NEG GEO PRI ACQ_INDEX Type-specific system ID record ROAM_IND ASSOCIATION_INC ASSOCIATION_TAG PN_ASSOCIATION DATA_ASSOCIATION RESERVED
5 6 7 8 9 10 11 12

1 2 3 4

Length (bits) 5 4 1 1 1 9 variable 0 or 8 1 0 or 8 0 or 1 0 or 1 0 to 7

SYS_RECORD_LENGTH -

Extended System Record Length. This field is set to the length of the Extended System Record in octets.

SYS_RECORD_TYPE

Extended System Record Type. This field is set to the type of this Extended System Record (see Table 3.5.5.3.2-1).

Table 3.5.5.3.2-1 Type-specific system ID record SYS_RECORD_TYPE 0000 0001 0010 0011 0100 - 1111 Parameter Description cdma2000 1x and IS-95 Systems HRPD System Reserved for Obsolete Identification MCC-MNC based System Record Reserved A base station should not set the SYS_RECORD_TYPE field to 0010. A mobile station that receives a record with the SYS_RECORD_TYPE field set to 0010 should ignore the record.

13 14 15 16

3-130

3GPP2 C.S0016-D v2.0 PREF_NEG Preferred/negative system. This field is set to 1 if the mobile station is allowed to operate on the system associated with this record. This field is set to 0 if the mobile station is not allowed to operate on the system associated with this record. GEO Geographical region indicator. If this is the first system record, this field is set to 0. If this is not the first system record, then this field is set as follows: If the system associated with this record is in the same geographical region as the system associated with the previous system record, this field is set to 1; otherwise, this field is set to 0. PRI Relative priority indicator. This field is set as follows: If this is the last system record in the specific geographical region, or if the PREF_NEG field in the next system record is equal to0, this field is set to 0 and has no meaning. If the system associated with this system record is more desirable than the system associated with the next system record, this field is set to 1. If the system associated with this system record is as desirable as the system associated with the next system record, this field is set to 0. ACQ_INDEX Acquisition record index. This field is set to the index of the acquisition record that specifies the acquisition parameters for the system associated with this record. Note: The index of the nth acquisition record is n-1. For example, the index of the first acquisition record in ACQ_TABLE is 0, and the index for the fourth acquisition record is 3. RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

28 29 30 31 32 33 34 35 36 37 38 39 40

The type-specific system ID record is set according to the value of the SYS_RECORD_TYPE field as follows: If the SYS_RECORD_TYPE is set to 0000, the type-specific system ID is as specified in Table 3.5.5.3.2-2:

3-131

3GPP2 C.S0016-D v2.0 Table 3.5.5.3.2-2 Type-specific system ID record System ID Record Field RESERVED NID_INCL SID NID
2 3 4 5 6 7

Length (bits) 1 2 15 0 or 16

RESERVED NID_INCL

Reserved bit. This field shall be set to 0. NID included. This field is set to the value defined in Table 3.5.5.3.2-3.

Table 3.5.5.3.2-3 NID_INCL Values NID_INCL Value 00 01 10 11 Parameter Description NID not included. Assume NID value 1111111111111111 NID included NID not included. Assume NID value 0000000000000000 Reserved

8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

SID

System identification. This field is set to the SID of the system associated with this record. The value 000000000000000 denotes a system with any SID (i.e., serves as a SID wildcard) not specifically included elsewhere in SYS_TABLE, provided that the system is found on a channel or in a block specified in the acquisition record corresponding to ACQ_INDEX. Any other value of this field denotes a system with that specific SID found on any channel.

NID

Network identification. If the NID_INCL field of this record is equal to 01, this field is included and is set to the NID of the network associated with this record; otherwise, this field is omitted. The value 1111111111111111 denotes any NID (i.e., serves as a NID wildcard). Not including the NID field is equivalent to including it and setting it to 1111111111111111. The value 0000000000000000 denotes a NID of the public system (see 6.6.5.2 of [1])

3-132

3GPP2 C.S0016-D v2.0 If the SYS_RECORD_TYPE is set to 0001, the type-specific system ID is as specified in Table 3.5.5.3.2-4: Table 3.5.5.3.2-4 Type-specific System ID Record System ID Record Field RESERVED SUBNET_COMMON_INCLUDED SUBNET_LSB_LENGTH SUBNET_LSB SUBNET_COMMON_OFFSET
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

1 2

Length (bits) 3 1 7 SUBNET_LSB_LENGTH 0 or 12

RESERVED

Reserved bit. This field shall be set to 000.

SUBNET_COMMON_INCLUDED Common part of the HRPD subnet included indicator. This field is set to 1 if the SUBNET_COMMON_OFFSET field is included. Otherwise this field is set to 0. SUBNET_LSB_LENGTH This field is set to the length of the least significant bits of the HRPD subnet. If SUBNET_COMMON_INCLUDED is set to 0, this field is set to the length of the HRPD subnet associated with this system record. This field is set to the least significant bits of the HRPD subnet of length specified by SUBNET_LSB_LENGTH. If SUBNET_COMMON_INCLUDED is set to 0, this field is set to the entire HRPD subnet associated with this system record. Common part of the HRPD subnet. If included, this field is set to the offset into the Common Subnet Table (see Table 3.5.5.3.2.1-1), in octets, that specifies the most significant bits of the subnet associated with this system record (e.g., a value of zero for this field points to the beginning of the Common Subnet Table). ROAM_IND If the PREF_NEG field of this record is equal to 1, this field is included and is set to the roaming indication value (see [4]TSB58) for the system associated with this record; otherwise, this field is omitted. Association tag included flag. This field is set to 1 if the next three fields are included. Otherwise, this field is set to 0.

SUBNET_LSB

SUBNET_COMMON_OFFSET -

ASSOCIATION_INC

3-133

3GPP2 C.S0016-D v2.0 ASSOCIATION_TAG If included, this field is set to the 8-bit number that specifies the set to which this system record belongs. The value of the ASSOCIATION_TAG field is only unique within a GEO. The set is defined as a set of systems (specified by the system records) for which at least one the following two conditions hold:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

The members of the set have the same PN offset assignment (i.e., collocated), or The members of the set can reach the same set of PDSNs (i.e., associated). PN_ASSOCIATION PN association flag. This field is only included if the ASSOCIATION_INC field is set to 1. If included, this field shall be set to 1 if the system identified by this system record has the same PN assignment as other systems in the same GEO that are members of the set identified by ASSOCIATION_TAG and whose PN_ASSOCIATION field is also set to 1. Otherwise, this field shall be set to 0. DATA_ASSOCIATION Data association flag. This field is only included if the ASSOCIATION_INC field is set to 1. If included, this field shall be set to 1 if the system identified by this system record can reach the same set of PDSNs as other systems in the same GEO that are members of the set identified by ASSOCIATION_TAG and whose DATA_ASSOCIATION field is also set to 1. Otherwise, this field shall be set to 0. 6 RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

6 The mobile station may use the value of this field to limit the set of systems in the GEO that it

should attempt to acquire. For example, the mobile station may choose to only acquire systems that can reach the same set of PDSNs (in order to avoid establishing two separate PPP session).

3-134

3GPP2 C.S0016-D v2.0

1 2 3

3.5.5.3.2.1 Common Subnet Table for the HRPD Extended System Record The Common Subnet Table for the HRPD Extended System Record consists of records with the following format: Table 3.5.5.3.2.1-1 Common Subnet Record System ID Record Field RESERVED SUBNET_COMMON_LENGTH SUBNET_COMMON 4 4 8 SUBNET_COMMON_LENGTH Length (bits)

5 6 7 8 9 10 11 12 13 14

RESERVED

Reserved bit. The mobile station shall set this field to 0000.

SUBNET_COMMON_LENGTH Length of the common part of the HRPD subnet. This field is set to the length of the most significant bits of the HRPD subnet which is included in this record. SUBNET_COMMON Common part of the HRPD subnet. This field is set to the most significant bits of the HRPD subnet which is included in this record. 3.5.5.3.2.2 Type-specific System ID Record of type 0011 If the SYS_RECORD_TYPE is set to 0011, the type-specific system ID is as specified in Table 3.5.5.3.2.2-1: Table 3.5.5.3.2.2-1 Type-specific system ID record System ID Record Field SYS_RECORD_SUBTYPE Subtype dependent field 3 Variable Length (bits)

15 16 17 18

19 20

SYS_RECORD_SUBTYPE -

This field shall determine the format of this record, as shown in the following table.

3-135

3GPP2 C.S0016-D v2.0 Table 3.5.5.3.2.2-2 SYS_RECORD_SUBTYPE Values SYS_RECORD_SU BTYPE 000 001 010 011 All other values
2 3 4 5 6 7

Parameter Description MCC, MNC Only MCC, MNC and multiple SIDs MCC, MNC and multiple SIDs, NIDs included MCC, MNC and multiple Subnet IDs Reserved

Subtype dependent record-

This field shall be SYS_RECORD_SUBTYPE.

set

as

per

the

value

of

Subtype dependent record for Subtype 000 Table 3.5.5.3.2.2-3 Subtype Dependent record for Subtype 000 Field Name MCC MNC Length (bits) 12 12 MCC MNC This field shall be set to the Mobile Country Code of the system using BCD encoding. This field shall be set to the Mobile Network Code of the system using BCD encoding. If the length of the MNC is two digits, the least significant digit is encoded with 0xFF. For example, MNC=23 is set to 0x23F23F [31].

8 9 10 11 12 13 14 15 16

Subtype dependent record for Subtype 001 Table 3.5.5.3.2.2-4 Subtype Dependent record for Subtype 001 Field Name MCC MNC RESERVED NUM_SID NUM_SID occurrences of the following field RESERVED SID 1 1516 MCC Mobile Country Code. Length (bits) 12 12 4 4

17

3-136

3GPP2 C.S0016-D v2.0 This field shall be set to the Mobile Country Code of the system using BCD encoding. MNC Mobile Network Code. This field shall be set to the Mobile Network Code of the system using BCD encoding. If the length of the MNC is two digits, the least significant digit is encoded with 0xFF. For example, MNC=23 is set to 0x23F23F [31]. RESERVED NUM_SID RESERVED SID Reserved bit. The mobile station shall set this field to 0000. Number of SID values. The number of SID values following this field. Reserved bit. The mobile station shall set this field to 0. System identification. This field is set to the SID of the system associated with this record. Subtype dependent record for Subtype 010 Table 3.5.5.3.2.2-5 Subtype Dependent record for Subtype 010 Field Name MCC MNC RESERVED NUM_SID_NID Length (bits) 12 12 4 4

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

NUM_SID_NID occurrences of the following two fields RESERVED SID NID

20 21 22 23 24 25 26 27 28 29

1 1516 16

MCC

Mobile Country Code. This field shall be set to the Mobile Country Code of the system using BCD encoding.

MNC

Mobile Network Code. This field shall be set to the Mobile Network Code of the system using BCD encoding. If the length of the MNC is two digits, the least significant digit is encoded with 0xFF. For example, MNC=23 is set to 0x23F23F [31].

RESERVED

Reserved bit.

3-137

3GPP2 C.S0016-D v2.0 This field shall be set to 0000. NUM_SID_NID RESERVED SID Number of SID and NID values The number of SID and NID values following this field. Reserved bit. This field shall be set to 0. System identification. This field is set to the SID of the system associated with this record. NID Network identification. This field is set to the NID of the system associated with this record. Subtype dependent record for Subtype 011 Table 3.5.5.3.2.2-6 Subtype Dependent record for Subtype 011 Field Name MCC MNC RESERVED NUM_SUBNET_ID 12 12 4 4 Length (bits)

1 2 3 4 5 6 7 8 9 10 11 12 13 14

NUM_SUBNET_ID occurrences of the following threetwo fields: SUBNET_LENGTH SUBNET_ID RESERVED RESERVED
15 16 17 18 19 20 21 22 23 24 25

8 SUBNET_LENGTH 0 to 7 0 or 4

MCC

Mobile Country Code. This field shall be set to the Mobile Country Code of the system using BCD encoding.

MNC

Mobile Network Code. This field shall be set to the Mobile Network Code of the system using BCD encoding. If the length of the MNC is two digits, the least significant digit is encoded with 0xFF. For example, MNC=23 is set to 0x23F23F [31].

RESERVED

Reserved bits. This field shall be set to 0000.

3-138

3GPP2 C.S0016-D v2.0 NUM_SUBNET_ID SUBNET_LENGTH Number Subnet ID. The number of Subnet ID values following this field. Subnet ID Length. This field specifies the length of the Subnet ID. The maximum SUBNET_LENGTH is 128. The values '10000001' (129) to 11111111 (255) shall be reserved. Note: when the SUBNET_LENGTH is 128, the SUBNET_ID is equivalent to the SECTOR_ID. SUBNET_ID Subnet ID. This field is set to the SUBNET_ID. SUBNET_COMMON_LENGTH - Length of the common part of the HRPD subnet. This field is set to the length of the most significant bits of the HRPD subnet which is included in this record. The maximum SUBNET_COMMON_LENGTH is 128. The values '10000001' (129) to 11111111 (255) shall be reserved. Note: when the SUBNET_COMMON_LENGTH is 128, the SUBNET_ID is equivalent to the SECTOR_ID. SUBNET_COMMON Common part of the HRPD subnet. This field is set to the most significant bits of the HRPD subnet which is included in this record. RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the combined length of SUBNET_LENGTH to RESERVED in each set of the three fields this subtype dependent record the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'. 3.5.6 PUZL Parameter Blocks Table 3.5.6-1 lists the types of parameter blocks used in the PUZL Configuration Request Message and the PUZL Configuration Response Message.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

27 28 29

3-139

3GPP2 C.S0016-D v2.0 Table 3.5.6-1. PUZL Parameter Block Types PUZL Parameter Block Type PUZL Dimensions PUZL Priorities User Zone Preferred User Zone List Reserved for future standardization BLOCK_ID 00000000 00000001 00000010 00000011 00000100 through 01111111 Available for manufacturer-specific parameter block definitions 10000000 through 11111110 Reserved
2

Reference 3.5.6.1 3.5.6.2 3.5.6.3 3.5.6.4

See [4]

11111111

3-140

3GPP2 C.S0016-D v2.0 3.5.6.1 PUZL Dimensions Parameter Block The PARAM_DATA field of the PUZL Dimensions Parameter Block consists of the following fields: Field UZ_LIST_ID CUR_PUZL_P_REV MAX_UZ_LIST_SIZE CUR_UZ_LIST_SIZE MAX_NUM_UZ CUR_NUM_UZ UZ_MAX_SIZE UZ_ORIG_ONLY UZ_TEMP_SUBSC MANUAL_UPDATE_ALLOWED MANUAL_ACQ_ALLOWED PUZL_PRL_RELATIVE_PRIORITY PREF_ONLY UZ_DISP_IND UZ_CIRCLE_FLAG UZ_POLYGON_FLAG UZ_LINEAR_FLAG UZ_TYPE1_FLAG UZ_TYPE2_FLAG UZ_TYPE3_FLAG UZ_TYPE4_FLAG UZ_TYPE5_FLAG UZ_TYPE6_FLAG RESERVED
5 6 7 8 9

1 2 3 4

Length (bits) 16 8 24 24 12 12 12 1 1 1 1 1 1 8 1 1 1 1 1 1 1 1 1 5

UZ_LIST_ID

User Zone List Identifier The mobile station shall set this field to the value of the Preferred User Zone List Identification assigned for the preferred user zone list (PUZLs-p) by the base station.

3-141

3GPP2 C.S0016-D v2.0 CUR_PUZL_P_REV Protocol revision of the mobile stations current prefered user zone list The mobile station shall set this field to the value of the PUZL_P_REV associated with its current preferred user zone list (PUZLs-p). MAX_UZ_LIST_SIZE Maximum preferred user zone list size. The mobile station shall set this field to the maximum size, in octets, that the mobile station can support for the preferred user zone list (PUZLs-p). CUR_UZ_LIST_SIZE Current preferred user zone list size. The mobile station shall set this field to the size, in octets, of the current preferred user zone list. MAX_NUM_UZ Maximum number of User Zone entries. The mobile station shall set this field to the maximum number of user zone entries that the mobile station can support. CUR_NUM_UZ Current number of User Zone entries. The mobile station shall set this field to the number of user zone entries currently stored in the preferred user zone list in the mobile station. UZ_MAX_SIZE Maximum User Zone Size. The mobile station shall set this field to the maximum user zone size, in octets, it can support. UZ_ORIG_ONLY User Zone Origination Only Flag. The mobile station shall set this field corresponding to its current setting to indicate whether or not the mobile station is permitted to originate calls only when within the serving area of a currently assigned User Zone. If call origination is only allowed within an assigned user zone, UZ_ORIG_ONLY = 1; otherwise, UZ_ORIG_ONLY = 0. UZ_TEMP_SUBSC User Zone Temporary Subscription Flag. The mobile station shall set this field corresponding to its current setting to indicate whether or not it is permitted to access User Zones that offer temporary subscription. If allowed, UZ_TEMP_SUBSC = 1; otherwise, UZ_TEMP_SUBSC = 0. MANUAL_UPDATE_ALLOWED - Manual Update Allowed Flag. When set to 1, this field indicates that manual updates are allowed in this database allowing the user to add records, and modify or delete the records added by the user in the database. When set to 0 this field indicates no manual updates are allowed in this database.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43

3-142

3GPP2 C.S0016-D v2.0 MANUAL_ACQ_ALLOWED - Manual Acquisition Allowed Flag. When set to 1, this field indicates that the user is allowed to manually initiate scan and acquisition of an access point. When set to 0, this field indicates that the user is not allowed to initiate manual scan looking for available systems. PUZL_PRL_RELATIVE_PRIORITY - PUZL PRL Relative Priority flag. When set to 1, this field indicates PUZL takes precedence over PRL. When determining the sequencing of the bands/frequencies to scan applied along with the other techniques, the mobile shall provide a higher priority to the PUZL entries compared to the PRL entries. When set to 0, this field indicates PRL takes precedence over PUZL. When determining the sequencing of the bands/frequencies to scan applied along with the other techniques, the mobile shall provide a higher priority to the PRL entries compared to the PUZL entries. PREF_ONLY Preferred only flag. When set to 1 this field indicates that when the mobile station performs scans based on PUZL, the mobile station is restricted to acquire only those valid systems identified in PUZL. When set to 0 this field indicates that when the mobile station performs scans based on PUZL, it may acquire valid systems identified in PUZL and other systems not identified in PUZL. UZ_DISP_IND User Zone Display Indicator The mobile station shall set this field to the value of the action for displaying the default UZ indicator on the mobile stations display if this feature is supported by the MS. The value assignments are defined in [4]. UZ_CIRCLE_FLAG User Zone Circle Flag. The mobile station shall set this field corresponding to its capability to support the Circle User Zone Type. If supported, UZ_CIRCLE_FLAG = 1; otherwise, UZ_CIRCLE_FLAG = 0. UZ_POLYGON_FLAG User Zone Polygon Flag. The mobile station shall set this field corresponding to its capability to support the Polygon User Zone Type. If supported, UZ_POLYGON_FLAG = 1; otherwise, UZ_POLYGON_FLAG = 0. UZ_LINEAR_FLAG User Zone Segmented Linear Flag. The mobile station shall set this field corresponding to its capability to support the Segmented Linear User Zone Type. If supported, UZ_LINEAR_FLAG = 1; otherwise, UZ_LINEAR_FLAG = 0. UZ_TYPE1_FLAG User Zone Type 1 Flag.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45

3-143

3GPP2 C.S0016-D v2.0 The mobile station shall set this field corresponding to its capability to support the User Zone Type 1: Broadcast RF Coverage Based User Zone Type. If supported, UZ_TYPE1_FLAG = 1; otherwise, UZ_TYPE1_FLAG = 0. UZ_TYPE2_FLAG User Zone Type 2 Flag. The mobile station shall set this field corresponding to its capability to support the User Zone Type 2: Broadcast GeoBased User Zone Type. If supported, UZ_TYPE2_FLAG = 1; otherwise, UZ_TYPE2_FLAG = 0. UZ_TYPE3_FLAG User Zone Type 3 Flag. The mobile station shall set this field corresponding to its capability to support the User Zone Type 3: Mobile Specific RF Coverage Based - Overhead Parameter Determined User Zone Type. If supported, UZ_TYPE3_FLAG = 1; otherwise, UZ_TYPE3_FLAG = 0. UZ_TYPE4_FLAG User Zone Type 4 Flag. The mobile station shall set this field corresponding to its capability to support the User Zone Type 4: Mobile Specific Geo-Based User Zone Type. If supported, UZ_TYPE4_FLAG = 1; otherwise, UZ_TYPE4_FLAG = 0. UZ_TYPE5_FLAG User Zone Type 5 Flag. The mobile station shall set this field corresponding to its capability to support the User Zone Type 5: Mobile Specific Geo Based - Separate Carrier User Zone Type. If supported, UZ_TYPE5_FLAG = 1; otherwise, UZ_TYPE5_FLAG = 0. UZ_TYPE6_FLAG User Zone Type 6 Flag. The mobile station shall set this field corresponding to its capability to support the User Zone Type 6: Mobile Specific RF Coverage and Geo-Based User Zone Type. If supported, UZ_TYPE6_FLAG = 1; otherwise, UZ_TYPE6_FLAG = 0. RESERVED Reserved bits. The mobile station shall set this field to 00000.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

3-144

3GPP2 C.S0016-D v2.0 3.5.6.2 PUZL Priorities Parameter Block The PARAM_DATA field of the PUZL Priorities Parameter Block consists of the following fields: Field LAST_SEGMENT SEGMENT_SEQ NUM_UZ_ENTRIES 1 16 8 Length (bits)

1 2 3 4

NUM_UZ_ENTRIES occurrences of the following three parameters: UZ_ID UZ_SID UZ_PRIORITY 16 15 4

The parameter block ends with the following field: RESERVED

5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

0 to 7

LAST_SEGMENT

Last segment indicator bit. The mobile station shall set this field to 1 if this parameter block contains the user zone ID, SID and priority information for the last entry of the current preferred user zone list (PUZLs-p); otherwise, the mobile station shall set this field to 0.

SEGMENT_SEQ

Segment sequence number. The base station shall set this field to the sequence number of each segment starting from 0000000000000000 with the sequence number incremented by 1 for each subsequent segment.

NUM_UZ_ENTRIES

Number of User Zone Entries. The mobile station shall set this field to the number of user zone entries included in the parameter block. If UZ_ID and UZ_SID are not present in PUZL, then the mobile station shall set this field to zero. No UZ_ID, UZ_SID and UZ_PRIORITY fields shall be included.

UZ_ID

User Zone ID. Identification number for the User Zone. This is used over the air interface to identify the User Zone to the network and the mobile station. The UZ_ID values are defined based on Table 3.5.1.13-1.

UZ_SID

User Zone System ID.

3-145

3GPP2 C.S0016-D v2.0 The System Identifier (SID) associated with the User Zone ID. The User Zone ID and User Zone SID values together provide a unique identifier for the user zone. UZ_PRIORITY User Zone priority. This field indicates the priority level of a user zone. When more than one UZ is available, the UZ with the highest priority that is not NULLUZ_PRIORITY takes precedence. A lower value indicates a higher priority; that is UZ_PRIORITY='0000' has a higher priority than UZ_PRIORITY='0001'. A priority of NULLUZ_PRIORITY indicates that a User Zone is for manual selection only. Note: UZ_PRIORITY is not unique; two or more UZs can have the same priority. This field indicates the priority level of a user zone. When more than one UZ is available, the UZ with the highest priority takes precedence. A priority of null NULLUZ_PRIORITY indicates that a User Zone is for manual selection only. A mobile station will never automatically select a User Zone of priority null unless initiated manually by the user. Note: UZ_PRIORITY is not unique; two or more UZs can have the same priority that the value of User Zone Priority is nonexclusive. A lower value indicates a higher priority, that is UZ_PRIORITY='0000' has a higher priority than UZ_PRIORITY='0001'. And NULL is indicated by UZ_PRIORITY = '1111'. RESERVED Reserved bits. The mobile station shall add reserved bits in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set these bits to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

35 36 37

3.5.6.3 User Zone Parameter Block The PARAM_DATA field of the User Zone Parameter Block consists of the following fields:

3-146

3GPP2 C.S0016-D v2.0

Field UZ_ID UZ_SID LAST_SEGMENT SEGMENT_SEQ SEGMENT_SIZE SEGMENT_DATA

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

Length (bits) 16 15 1 16 8 8 SEGMENT_SIZE

UZ_ID

User Zone ID. Identification number for the User Zone. This is used over the air interface to identify the User Zone to the network and the mobile station. The UZ_ID values are defined based on Table 3.5.1.13-1.

UZ_SID

User Zone System ID. The System Identifier (SID) associated with the User Zone ID. The User Zone ID and User Zone SID values together provide a unique identifier for the user zone.

LAST_SEGMENT

Last segment indicator bit. The mobile station shall set this field to 1 if SEGMENT_DATA contains the last octet of the user zone entry; otherwise, the mobile station shall set this field to 0.

SEGMENT_SEQ

Segment sequence number. The mobile station shall set this field to the sequence number of each segment starting from 00000000 with the sequence number incremented by 1 for each subsequent segment.

SEGMENT_SIZE

Segment size. The mobile station shall set this field to the number of octets of the user zone entry included in SEGMENT_DATA.

SEGMENT_DATA

Segment of the specified user zone entry of the PUZL. Refer to Section 3.5.7.

25 26 27 28

3.5.6.4 Preferred User Zone List Parameter Block The PARAM_DATA field of the Preferred User Zone List Parameter Block consists of the following fields:

3-147

3GPP2 C.S0016-D v2.0

Field NUM_ENTRIES 8

Length (bits)

NUM_ENTRIES occurrences of the following: RESERVED LAST_SEGMENT SEGMENT_SEQ SEGMENT_SIZE SEGMENT_DATA

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

7 1 16 8 8 SEGMENT_SIZE

NUM_ENTRIES

Number of User Zone entries. The mobile station shall set this field to the number of user zone entries included in the parameter block.

RESERVED LAST_SEGMENT

Reserved bits. The mobile station shall set this field to 0000000. Last segment indicator bit. The mobile station shall set this field to 1 if SEGMENT_DATA contains the last octet of the user zone entry; otherwise, the mobile station shall set this field to 0.

SEGMENT_SEQ

Segment sequence number. The base station shall set this field to the sequence number of each segment starting from 00000000 with the sequence number incremented by 1 for each subsequent segment.

SEGMENT_SIZE

Segment size. The mobile station shall set this field to the number of octets of the user zone entry included in SEGMENT_DATA.

SEGMENT_DATA

Segment of the PUZL data for Preferred User Zone List Parameter Block. Refer to Section 3.5.7 for more details.

22 23 24 25 26 27 28 29 30

3.5.7 Preferred User Zone List (PUZL) The Preferred User Zone List (PUZLS-P) provides the mobile station with the priority and characteristics of the User Zones to which the mobile station is subscribed. The relative priority between the PUZL and the PRL databases is used to determine the scan sequence Based on the relative priority between the PUZL and PRL databases entries, the mobile may determine the scan sequence along with other techniques in performing system acquisition. Once a mobile station has found its preferred system, the PUZL is used to select the most preferred User Zone on that system. It should be noted that PUZL could have up to 4095 User Zone entries. A User Zone entry includes all of the information associated with the

3-148

3GPP2 C.S0016-D v2.0 definition of a single user zone that is uniquely identified by the combination of User Zone ID and User Zone SID. The following sections define the parameters that are stored in the PUZL:

1 2 3 4

3-149

3GPP2 C.S0016-D v2.0

Field UZ_LIST_ID CUR_PUZL_P_REV RESERVED UZ_TEMP_SUBSC UZ_ORIG_ONLY MANUAL_UPDATE_ALLOWED MANUAL_ACQ_ALLOWED PUZL_PRL_RELATIVE_PRIORITY PREF_ONLY UZ_DISP_IND NUM_UZ_ENTRIES { (NUM_UZ_ENTRIES)7 UZ_INFO_FLAG UZ_PRIORITY UZ_ID UZ_SID UZ_NAME_ENCODING N_OCTETS UZ_NAME ACTIVE_FLAG PRIORITY_CONTROL REG_REQ_FLAG NOTIFICATION_FLAG UZ_REVISION UZ_TYPE NUM_ELEMENTS 1 4 16 16 8 2 1 1 1 1 1 1 8 12

Length (bits)

NUM_UZ_ENTRIES occurrences of the following User Zone entry:

15 or 0 8 or 0 5 or 0 8 N_OCTETS 1 or 0 3 1 1 or 0 4 3 4

NUM_ELEMENTS occurrences of the following field: UZ Type Specific Fields Variable

7 The sequence of fields enclosed between { (NUM_xyz) } (NUM_xyz) are repeated NUM_xyz

times.

3-150

3GPP2 C.S0016-D v2.0

} (NUM_UZ_ENTRIES) The User Zone entry ends with the following two fields: RESERVED UZ_CRC
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37

0 to 7 16

UZ_LIST_ID

User Zone List Identifier The mobile station shall set this field to the value of the Preferred User Zone List Identification assigned for the preferred user zone list (PUZLs-p) by the base station.

CUR_PUZL_P_REV

Protocol revision of the mobile stations current prefered user zone list The mobile station shall set this field to the value of the PUZL_P_REV associated with its current preferred user zone list (PUZLs-p).

RESERVED UZ_TEMP_SUBSC

Reserved bits. The mobile station shall set this field to 00. User Zone Temporary Subscription Flag. This flag indicates whether or not the mobile station is permitted to access User Zones that offer temporary subscription. This field does not apply to a specific User Zone and is per MS. If allowed, UZ_TEMP_SUBSC = 1; otherwise, UZ_TEMP_SUBSC = 0.

UZ_ORIG_ONLY

User Zone Origination Only Flag. This flag indicates whether or not the mobile station is permitted to originate calls only when within the serving area of a currently assigned User Zone. If call origination is only allowed within an assigned user zone, UZ_ORIG_ONLY = 1; otherwise, UZ_ORIG_ONLY = 0.

MANUAL_UPDATE_ALLOWED - Manual update allowed flag. When set to 1 this field indicates if manual updates are allowed in this database allowing the user to add records, and modify or delete the records added by the user in the database. When set to 0 this field indicates no manual updates are allowed in this database. MANUAL_ACQ_ALLOWED - Manual acquisition allowed flag. When set to 1 this field indicates if the user is allowed to manually initiate scan and acquisition of an access point. When set to 0 this field indicates that the user is not allowed to initiate manual scan looking for available systems. PUZL_PRL_RELATIVE_PRIORITY - PUZL PRL Relative Priority flag.

3-151

3GPP2 C.S0016-D v2.0 When set to 1 this field indicates PUZL takes precedence over PRL. When determining the sequencing of the bands/frequencies to scan applied along with the other techniques, the mobile shall provide a higher priority to the PUZL entries compared to the PRL entries. When set to 0 this field indicates PRL takes precedence over PUZL. When determining the sequencing of the bands/frequencies to scan applied along with the other techniques, the mobile shall provide a higher priority to the PRL entries compared to the PUZL entries. PREF_ONLY Preferred only flag. When set to 1 this field indicates that when the mobile station performs scans based on PUZL, the mobile station is restricted to acquire only those valid systems identified in PUZL. When set to 0 this field indicates that when the mobile station performs scans based on PUZL, it may acquire valid systems identified in PUZL and other systems not identified in PUZL. UZ_DISP_IND User Zone Display Indicator The mobile station shall set this field to the value of the action for displaying the default UZ indicator on the mobile stations display if this feature is supported by the MS. The value assignments are defined in [4]. NUM_UZ_ENTRIES UZ_INFO_FLAG Current number of User Zone entries. Number of User Zone entries currently in the mobiles PUZL. User Zone Information present flag. If UZ_INFO_FLAG is set to 1, this field indicates that the user zone information is specified for this record. Otherwise, this field indicates that the user zone information is not specified for this record. UZ_PRIORITY User Zone priority. This field indicates the priority level of a user zone. When more than one UZ is available, the UZ with the highest priority that is not NULLUZ_PRIORITY takes precedence. A lower value indicates a higher priority; that is UZ_PRIORITY='0000' has a higher priority than UZ_PRIORITY='0001'. A priority of NULLUZ_PRIORITY indicates that a User Zone is for manual selection only. Note: UZ_PRIORITY is not unique; two or more UZs can have the same priority.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

3-152

3GPP2 C.S0016-D v2.0 This field indicates the priority level of a user zone. When more than one UZ is available, the UZ with the highest priority takes precedence. A priority of null NULLUZ_PRIORITY indicates that a User Zone is for manual selection only. A mobile station will never automatically select a User Zone of priority null unless initiated manually by the user. Note that the value of User Zone Priority is non-exclusive.Note: UZ_PRIORITY is not unique; two or more UZs can have the same priority. A lower value indicates a higher priority, that is UZ_PRIORITY='0000' has a higher priority than UZ_PRIORITY='0001'. And NULL is indicated by UZ_PRIORITY = '1111'. UZ_ID User Zone ID. Identification number for the User Zone. This is used over the air interface to identify the User Zone to the network and the mobile station. The UZ_ID values are defined based on Table 3.5.1.13-1. UZ_SID User Zone System ID. If UZ_INFO_FLAG is set to '1', this field is set to the System Identifier (SID) associated with the User Zone ID. Otherwise, it is omitted. The User Zone ID and User Zone SID values together provide a unique identifier for the user zone. UZ_NAME_ENCODING User Zone name encoding. Specified when UZ_INFO_FLAG is set to 1 and omitted otherwise. A field indicating the character set the User Zone Name is encoded in as per ANSI-41 (See [4]TSB-58). N_OCTETS Number of octets. Specified when UZ_INFO_FLAG is set to 1 and omitted otherwise. Number of octets in the User Zone name. UZ_NAME User Zone name. Specified when UZ_INFO_FLAG is set to 1 and omitted otherwise. Up to 12-character field used in the mobile station to indicate to the mobile station the Name of the User Zone the mobile station is currently subscribed to. Encoded as per the previous field. ACTIVE_FLAG Active flag. Specified when UZ_INFO_FLAG is set to 1 and omitted otherwise. With this flag set to 1, the mobile station must register upon entering or exiting this particular User Zone. If allowed, ACTIVE_FLAG = 1; otherwise, ACTIVE_FLAG = 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

3-153

3GPP2 C.S0016-D v2.0 PRIORITY_CONTROL Priority Control. A 3 bit field that controls the ability of the user to modify PUZL priorities using the user interface of the mobile. The following states are defined at this time: State No changes permitted Manual Value 000 Description The user may not modify or override the PUZL priorities in any way. Permitted to select manually amongst the User Zones present. Upon exiting the User Zone the Mobile will revert back to the PUZL priorities. The user is also permitted to change the priorities of the PUZL for this User Zone. The change will remain in effect until the next power down.

1 2 3 4 5

001

Manual and Temporary

010

Reserved

011 through 111

6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

REG_REQ_FLAG

Registration Required flag. When this flag is set to 1 and a mobile station moves within the coverage area of a User Zone, this flag can be used to indicate that the mobile is to register when it acquires an associated system in this User Zone. This also indicates that when the mobile is associated with a system associated with this User Zone, it shall register upon switching from PN to another PN independent of whether the target system belongs to the same/different SID/NID compared to the source.

NOTIFICATION_FLAG

Notification flag. Specified when UZ_INFO_FLAG is set to 1 and omitted otherwise. When this flag is set to 1 and a mobile station moves within the coverage area of a User Zone, this flag can be used to indicate to the user that the User Zone is present. This flag would typically be used for User Zones that are set for manual selection only (User Zone Priority = nullNULLUZ_PRIORITY) but that the subscriber wishes to be informed of its presence.

3-154

3GPP2 C.S0016-D v2.0 UZ_REVISION User Zone revision. This indicates the current revision of this entry in the PUZL. For Broadcast User Zones, the mobile station uses this value to determine if the network has more current information about the particular User Zone. UZ_TYPE User Zone type. This field is used to distinguish between the following types of User Zones: Table 3.5.7-1 User Zone Type Values User Zone Type UZ_TYPE_1: Broadcast RF Coverage Based UZ_TYPE_2: Broadcast Geo-Based UZ_TYPE_3: Mobile Specific RF Coverage Based - Overhead Parameter Determined UZ_TYPE_4: Mobile Specific Geo-Based UZ_TYPE_5: Mobile Specific - Geo Based Separate Carrier UZ_TYPE_6: Mobile Specific RF Coverage and Geo Based Reserved Value 000 001 010 011 100 101 110 through 111

1 2 3 4 5 6 7 8 9

10 11 12 13 14

NUM_ELEMENTS

Number of elements. This is the number of User Zone type specific fields that follow according to the following table. User Zone Type 000 001 010 011 100 101 NUM_ELEMENTS 0 Variable Variable Variable 1 1 Type of Elements None Geo Types OHP Types Geo Types Geo-Based Separate Carrier RF Coverage and Geo Based

15

3-155

3GPP2 C.S0016-D v2.0 UZ Type Specific Fields RESERVED User Zone type specific fields. Refer to Section 3.5.7.1. Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'. UZ_CRC User Zone Cyclic Redundancy Check. Set to the computed value of the CRC including all the fields for this user zone entry except for this field. The 16-bit CRC is calculated according to 3.5.5.1.

1 2 3 4 5 6 7 8 9 10 11 12

13 14 15

3.5.7.1 User Zone Type Specific Fields This section describes User Zone Type specific fields associated with a User Zone.

16 17 18

3.5.7.1.1 User Zone Type 1: Broadcast RF Coverage Based No data required.

19 20 21 22 23

3.5.7.1.2 User Zone Type 2: Broadcast Geo-based

Table 3.5.7.1.2-1 below lists all the supporting Geo Types and corresponding values.

Table 3.5.7.1.2-1 Geo Type Values Geo Type Circle Segmented Linear Polygon Reserved Value 000 001 010 011 through 100

24 25 26

For Geo Type Specific Fields see 3.5.7.1.2.1 3.5.7.1.2.3.

3-156

3GPP2 C.S0016-D v2.0 3.5.7.1.2.1 Circle The Circle Geo Type has the following format: Geo Type Field GEO_TYPE (000) ANCHOR_LATITUDE ANCHOR_LONGITUDE ANCHOR_HEIGHT_MID_PT ANCHOR_HEIGHT_MAG RADIUS HYSTERESIS RESERVED
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

1 2 3

Length (bits) 3 23 22 16 9 10 4 1

GEO_TYPE ANCHOR_LATITUDE

Geo Type. This field is set to 000 (see Table 3.5.7.1.2-1). Anchor latitude. Latitude of the center of the circle in units of 0.25 second, expressed as a twos complemented signed number with positive numbers signifying North latitudes. Values over the range of -1296000 to 1296000 inclusive (corresponding to a range of -90 to +90) are valid.

ANCHOR_LONGITUDE

Anchor longitude. Longitude of the center of the circle in units of 0.25 second, expressed as a twos complemented signed number with positive numbers signifying East longitude. Values over the range of -2592000 to 2592000 inclusive (corresponding to a range of -180 to +180) are valid.

ANCHOR_HEIGHT_MID_PT - Anchor Height Mid-Point. This field is a twos complement signed value set to the height above the WGS-84 reference ellipsoid, in units of 1 meter, in the range from -500 m to 15883 m. This field defines the center point of the vertical range defined by ANCHOR_HEIGHT_MAG. ANCHOR_HEIGHT_MAG Anchor Height Magnitude This field is set to the magnitude of the height range in units of 1 m. The value of 0 indicates no height is specified.

3-157

3GPP2 C.S0016-D v2.0 RADIUS Radius. Radius of the circle in units of 0.25 second. The 10 bits are divided into a 7-bit mantissa and a 3-bit exponent providing a range of 0 to 127 x 27 x 0.25 seconds. HYSTERESIS Hysteresis. Hysteresis value expressed in units of 0.25 second. The mantissa is defined as '1' and the 4 bits represent the exponent. This provides hysteresis values of 1, 2 , 4, 8 128 x 0.25 sec. The hysteresis value delays the exiting of a user zone by a distance offset determined by the value of the hysteresis. The entry point for a user zone is the radius value (horizontally) or anchor height mid-point and anchor height magnitude value (vertically). RESERVED Reserved bits. The mobile station shall set this field to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

3-158

3GPP2 C.S0016-D v2.0 3.5.7.1.2.2 Segmented Linear The segmented linear user zone is defined by an anchor point and a series of points offset relative to each other. The area is formed by defining a distance (radius) offset from the line. The Segmented Linear Geo Type has the following format: Geo Type Field GEO_TYPE (001) ANCHOR_LATITUDE ANCHOR_LONGITUDE ANCHOR_HEIGHT_MID_PT ANCHOR_HEIGHT_MAG RADIUS HYSTERESIS N_POINTS N_POINTS of the following: LAT_OFFSET LONG_OFFSET 11 11 Length (bits) 3 23 22 16 9 10 4 5

1 2 3 4 5 6

RESERVED
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

0 to 7

GEO_TYPE ANCHOR_LATITUDE

Geo Type. This field is set to 001 (see Table 3.5.7.1.2-1). Anchor latitude. Latitude of the anchor point for the line in units of 0.25 second, expressed as a twos complemented signed number with positive numbers signifying North latitudes. Values over the range of -1296000 to 1296000 inclusive (corresponding to a range of -90 to +90) are valid.

ANCHOR_LONGITUDE

Anchor longitude. Longitude of the anchor point for the line in units of 0.25 second, expressed as a twos complemented signed number with positive numbers signifying East longitude. Values over the range of -2592000 to 2592000 inclusive (corresponding to a range of -180 to +180) are valid.

3-159

3GPP2 C.S0016-D v2.0 ANCHOR_HEIGHT_MID_PT - Anchor Height Mid-Point. This field is a twos complement signed value set to the height above the WGS-84 reference ellipsoid, in units of 1 meter, in the range from -500 m to 15883 m. This field defines the center point of the vertical range defined by ANCHOR_HEIGHT_MAG. ANCHOR_HEIGHT_MAG Anchor Height Magnitude This field is set to the magnitude of the height range in units of 1 m. The value of 0 indicates no height is specified. RADIUS Radius. Distance away from the line that the User Zone covers in units of 0.25 second. The 10 bits are divided into a 7-bit mantissa and a 3-bit exponent providing a range of 0 to 127 x 27 x 0.25 seconds. HYSTERESIS Hysteresis. Hysteresis value expressed in units of 0.25 second. The mantissa is defined as '1' and the 4 bits represent the exponent. This provides hysteresis values of 1, 2, 4, 8 128 x 0.25 sec. The hysteresis value delays the exiting of a user zone by a distance offset from the radius determined by the value of the hysteresis. The entry point for a user zone is the radius value (horizontally) or anchor height mid-point and anchor height magnitude value (vertically). N_POINTS LAT_OFFSET Number of points. Number of points of the following two values. Latitude offset. Latitude offset distance from the previous point in units of 0.25 seconds. The 11 bits are divided into an 8 bit mantissa (2's complement representation) and a 3 bit exponent providing a range of 0 to 127 x 27 x 0.25 seconds. LONG_OFFSET Longitude offset. Longitude offset distance from the previous point in units of 0.25 seconds. The 11 bits are divided into an 8 bit mantissa (2's complement representation) and a 3 bit exponent providing a range of 0 to 127 x 27 x 0.25 seconds. RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

3-160

3GPP2 C.S0016-D v2.0 3.5.7.1.2.3 Polygon The polygon is defined by an anchor vertex and a series of vertices offset from the anchor. The polygon is formed by lines formed between the vertices in the order they are provisioned starting with the anchor as the first vertex. A line is formed between the last point provisioned and the anchor to close the polygon. The Polygon Geo Type has the following format: Geo Type Field GEO_TYPE (010) ANCHOR_LATITUDE ANCHOR_LONGITUDE ANCHOR_HEIGHT_MID_PT ANCHOR_HEIGHT_MAG HYSTERESIS N_POINTS N_POINTS of the following: LAT_OFFSET LONG_OFFSET 11 11 3 23 22 16 9 4 5 Length (bits)

1 2 3 4 5 6 7

RESERVED
8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

0 to 7

GEO_TYPE ANCHOR_LATITUDE

Geo Type. This field is set to 010 (see Table 3.5.7.1.2-1). Anchor latitude. Latitude of the anchor point for one vertex on the polygon in units of 0.25 second, expressed as a twos complement signed number with positive numbers signifying North latitudes. Values over the range of -1296000 to 1296000 inclusive (corresponding to a range of -90 to +90) are valid.

ANCHOR_LONGITUDE

Anchor longitude. Longitude of the anchor point for one vertex on the polygon in units of 0.25 second, expressed as a twos complement signed number with positive numbers signifying East longitude. Values over the range of -2592000 to 2592000 inclusive (corresponding to a range of -180 to +180) are valid.

3-161

3GPP2 C.S0016-D v2.0 ANCHOR_HEIGHT_MID_PT - Anchor Height Mid-Point. This field is a twos complement signed value set to the height above the WGS-84 reference ellipsoid, in units of 1 meter, in the range from -500 m to 15883 m. This field defines the center point of the vertical range defined by ANCHOR_HEIGHT_MAG. ANCHOR_HEIGHT_MAG Anchor Height Magnitude This field is set to the magnitude of the height range in units of 1 m. The value of 0 indicates no height is specified. HYSTERESIS Hysteresis. Hysteresis value expressed in units of 0.25 second. The mantissa is defined as '1' and the 4 bits represent the exponent. This provides hysteresis values of 1, 2 , 4, 8 128 x 0.25 sec. The hysteresis value delays the exiting of a user zone by a distance offset from the polygon edge determined by the value of the hysteresis. The entry point for the polygon as defined by the lines joining the points on the polygon (horizontally) or anchor height mid point and anchor height magnitude value (vertically). N_POINTS LAT_OFFSET Number of points. Number of points of the following two values. Latitude offset. Latitude offset distance from the anchor point in units of 0.25 seconds. The 11 bits are divided into an 8 bit mantissa (2's complement representation) and a 3 bit exponent providing a range of 0 to 127 x 27 x 0.25 seconds. LONG_OFFSET Longitude offset. Longitude offset distance from the anchor point in units of 0.25 seconds. The 11 bits are divided into an 8 bit mantissa (2's complement representation) and a 3 bit exponent providing a range of 0 to 127 x 27 x 0.25 seconds. RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37

3-162

3GPP2 C.S0016-D v2.0 3.5.7.1.3 User Zone Type 3: Mobile Specific RF Coverage Based - Overhead Parameter Determined For this type of user zone, the mobile station matched parameters on the overhead channel with information in the PUZL. Below describes all the supporting Overhead Parameter (OHP) Types and corresponding values:

1 2 3 4 5 6 7 8

Table 3.5.7.1.3-1 Overhead Parameter (OHP) Type Values OHP Type SID Only SID and NID SID and BASE_ID Base station Latitude and Longitude User Zone Center Point and Radius Reserved Value 000 001 010 011 100 101 through 111

10 11 12 13

3.5.7.1.3.1 SID Only The SID comes from the common parameters defining the User Zone. The SID Only OHP Type has the following format: OHP Type Field OHP_TYPE (000) HYSTERESIS RESERVED 3 4 1 Length (bits)

14 15 16 17 18 19 20 21

OHP_TYPE HYSTERESIS

Overhead Parameter Type. This field is set to 000 (see Table 3.5.7.1.3-1). Hysteresis. Expressed in dB. See Section 2.6.9 of [7] for definition of hysteresis relative to CDMA Tiered Services.

RESERVED

Reserved bit The mobile station shall set this field to 0.

3-163

3GPP2 C.S0016-D v2.0

2 3 4

3.5.7.1.3.2 SID and NID The SID comes from the common parameters defining the User Zone. The SID and NID OHP Type has the following format:

OHP Type Field OHP_TYPE (001) N_ITEMS 3 5

Length (bits)

N_ITEMS occurrences of the following two fields: NID HYSTERESIS 16 4

RESERVED
6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

4 or 0

OHP_TYPE N_ITEMS NID HYSTERESIS

Overhead Parameter Type. This field is set to 001 (see Table 3.5.7.1.3-1). Number of items. Number of entries of the following two values. Network ID. See [7]. Hysteresis. Expressed in dB. See Section 2.6.9 of [7] for definition of hysteresis relative to CDMA Tiered Services for RF coverage based user zones.

RESERVED

Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

3-164

3GPP2 C.S0016-D v2.0 3.5.7.1.3.3 SID and BASE_ID The SID comes from the common parameters defining the User Zone. The SID and BASE_ID OHP Type has the following format:

1 2 3

OHP Type Field OHP_TYPE (010) N_ITEMS 3 5

Length (bits)

N_ITEMS occurrences of the following two fields: BASE_ID HYSTERESIS 16 4

RESERVED
5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

4 or 0

OHP_TYPE N_ITEMS BASE_ID HYSTERESIS

Overhead Parameter Type. This field is set to 010 (see Table 3.5.7.1.3-1). Number of items. Number of entries of the following two values. Base Station ID. See [7]. Hysteresis. Expressed in dB. See Section 2.6.9 of [7] for definition of hysteresis relative to CDMA Tiered Services for RF coverage based user zones.

RESERVED

Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

3-165

3GPP2 C.S0016-D v2.0 3.5.7.1.3.4 Base Station Latitude and Longitude The Base Station Latitude and Longitude OHP Type has the following format:

1 2

OHP Type Field OHP_TYPE (011) N_POINTS 3 5

Length (bits)

N_POINTS occurrences of the following three fields: BASE_LAT BASE_LONG HYSTERESIS 22 23 4

RESERVED
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

0 to 7

OHP_TYPE N_POINTS BASE_LAT BASE_LONG HYSTERESIS

Overhead Parameter Type. This field is set to 011 (see Table 3.5.7.1.3-1). Number of points. Number of points of the following three values. Base Station latitude. See [7]. Base Station longitude. See [7]. Hysteresis. Expressed in dB. See Section 2.6.9 of [7] for definition of hysteresis relative to CDMA Tiered Services for RF coverage based user zones.

RESERVED

Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

22 23 24 25 26

3.5.7.1.3.5 User Zone Center Point and Radius In this case, a circle is used to define the user zone. Any base station whose BASE_LAT and BASE_LONG fall within the circle are considered to define the user zone. The coverage area of these sites constitute the user zone. The User Zone Center Point and Radius HP Type has the following format:

3-166

3GPP2 C.S0016-D v2.0

OHP Type Field OHP_TYPE (100) CENTER_POINT_LAT CENTER_POINT_LONG RADIUS HYSTERESIS RESERVED
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

Length (bits) 3 23 22 10 4 2

OHP_TYPE CENTER_POINT_LAT

Overhead Parameter Type. This field is set to 100 (see Table 3.5.7.1.3-1). Center point latitude. Latitude of the center of the circle in units of 0.25 second, expressed as a twos complemented signed number with positive numbers signifying North latitudes. Values over the range of -1296000 to 1296000 inclusive (corresponding to a range of -90 to +90) are valid.

CENTER_POINT_LONG

Center point longitude. Longitude of the center of the circle in units of 0.25 second, expressed as a twos complemented signed number with positive numbers signifying East longitude. Values over the range of -2592000 to 2592000 inclusive (corresponding to a range of -180 to +180) are valid.

RADIUS

Radius. Radius of the circle in units of 0.25 second. The 10 bits are divided into a 7-bit mantissa and a 3-bit exponent providing a range of 0 to 127 x 27 x 0.25 seconds.

HYSTERESIS

Hysteresis. Expressed in dB. See Section 2.6.9 of [7] for definition of hysteresis relative to CDMA Tiered Services for RF coverage based user zones.

RESERVED

Reserved bits. The mobile station shall set this field to 00.

28 29

3.5.7.1.4 User Zone Type 4: Mobile Specific Geo-Based See section 3.5.7.1 2. The parameters are identical. 3.5.7.1.5 User Zone Type 5: Mobile Specific Geo-Based Separate Carrier This user zone type has the following format: 3-167

30 31

3GPP2 C.S0016-D v2.0

Field SID NID PN_INCLUDED PRI_NGHBR_PN BAND_CLASS NGHBR_FREQ NUM_ENTRIES 15 16 1 0 or 9 5 5 4

Length (bits)

NUM_ENTRIES occurrences of the following field: Geo Type Specific Fields Variable

RESERVED
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

0 to 7

SID NID PN_INCLUDED

System ID. The SID of the separate RF carrier. Network ID. The NID of the separate RF carrier. Private neighbor PN included indicator. Set to 1 if the Private Neighbor PN is included. Otherwise the mobile should due a full search of the frequency.

PRI_NGHBR_PN BAND_CLASS NGHBR_FREQ NUM_ENTRIES

Private neighbor PN offset. The PN offset of the private RF carrier. Private neighbor band class. The Band Class of the private RF carrier. Private neighbor frequency. The frequency of the private RF carrier. Number of entries. The number of Geo Type specific fields that follow. Geo Type specific fields. One or more Geo Type specific fields (see Section 3.5.7.1.2). Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

Geo Type Specific Fields RESERVED -

3-168

3GPP2 C.S0016-D v2.0 3.5.7.1.6 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based This user zone type is applicable to both same carrier and separate carriers. This user zone type has the following format:

1 2 3

3-169

3GPP2 C.S0016-D v2.0

Field REC_LENGTH PREF_NEG SYSTEM_INFO_LENGTH SYS_TYPE SYS_INFO AP_ID_INCLUDED AP_ID_MASK_LENGTH AP_ID_MSB AP_ID_TEXT_INCLUDED AP_ID_TEXT_LENGTH AP_ID_TEXT SERVICE_CAP_INFO_INCLUDED SERVICE_CAP_INFO LAT_LONG_INCLUDED LATITUDE LONGITUDE HEIGHT_INCLUDED HEIGHT ACQ_TYPE ACQ_INFO ASSOCIATED_HRPD USE_ASSOCIATED_UZ_RF_GEO_INFO NUM_UZ_RF_TYPES 16 1 8 8 variable 1 8 or 0

Length (bits)

AP_ID_MASK_LENGTH 1 8 or 0 8 x AP_ID_TEXT_LENGTH 1 32 or 0 1 23 or 0 24 or 0 1 16 or 0 8 variable 0 or 31 0 or 1 4

NUM_UZ_RF_TYPE occurrences of the following two fields: UZ_RF_TYPE UZ_RF_INFO 8 variable

NUM_GEO_TYPE_SPECIFIC_FIELDS

NUM_GEO_TYPE_SPECIFIC_FIELDS occurrences of the following field: GEO_TYPE_SPECIFIC_FIELDS Variable

RESERVED
1

0 to 7

3-170

3GPP2 C.S0016-D v2.0 REC_LENGTH Record Length. Set to the total length of this record in octets including this field. PREF_NEG System Type indicator. This field is set to 1 if the mobile station is allowed to operate on the system associated with this record. This field is set to 0 if the mobile station is not allowed to operate on the system associated with this record.8 SYSTEM_INFO_LENGTH System information length. Set to the length in octets of the system information contained in this record. This covers all the fields starting with and including this field up to and including the USE_ASSOCIATED_UZ_RF_GEO_INFO field. SYS_TYPE System Type indicator. Set according to the following table. SYS_TYPE Value 00000000 00000001 00000010 to 11111111
16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Description cdma2000 1x HRPD Reserved

SYS_INFO

System Information See Section 3.5.7.1.6.1 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based System Information.

AP_ID_INCLUDED

Access Point Identification Included This field is set to 1 if the AP_ID is included. Otherwise, it is set to 0.

AP_ID_MASK_LENGTH

Access Point Identification Mask Length If AP_ID_INCLUDED is set to 1, then this field specifies the number of consecutive bits (starting from the most significant bit) of AP_ID which can identify a group of access points or a single access point. Note: when the AP_ID_MASK_LENGTH is equivalent to the full length of the AP_ID, the AP_ID_MSBS is equivalent to the AP_ID. The AP_ID_MASK_LENGTH may be broadcasted by a base-station in an overhead signaling message. Otherwise, if AP_ID_INCLUDED is set to 0, then this field is excluded.

8 Creation and configuration of the PUZL information entries with PREF_NEG set to '0' is under

control of the system operator and is subject to system operator policy.

3-171

3GPP2 C.S0016-D v2.0 AP_ID_MSB Access Point Identification Most Significant Bits. Set to most significant bits of AP_ID limited to the length specified by AP_ID_MASK_LENGTH. The AP_ID may be broadcasted by a base-station in an overhead signaling message. AP_ID_TEXT_INCLUDED Access Point Identification Text Included This field is set to 1 if the AP_ID_TEXT is included. Otherwise, it is set to 0. AP_ID_TEXT_LENGTH Access Point Identification Text Length. If AP_ID_TEXT_INCLUDED is set to 1, then this field is set to the number of octets in the AP_ID_TEXT field following the AP_ID_TEXT_LEN field. Otherwise, this field is excluded. AP_ID_TEXT Access Point text identification. The AP_ID_TEXT field shall include the following fields: MSG_ENCODING NUM_FIELDS 5 8

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

NUM_FIELDS occurrences of the following field CHARi Variable

RESERVED
16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

0 to 7

MSG_ENCODING

Message encoding. See [4]. Support of an encoding method does not imply that the entire encodable character set needs to be supported. In general, once the supported character set is determined, various subsets of the character set can be supported. If a message is comprised entirely of characters from a supported subset of a character set, it can be displayed. If a message contains an unsupported character of a character set, it can be discarded.

NUM_FIELDS

Number of fields. If the MSG_ENCODING field is set to 00101 (Shift-JIS) or 00110 (Korean), this field indicates the total length in octets of the CHARi field; otherwise this field shall be set to the number of characters included in this occurrence of the encoding-specific-fields.

3-172

3GPP2 C.S0016-D v2.0 CHARi Character. See [4]. NUM_FIELDS occurrences of this field shall be included. The base station shall set each occurrence of this field to represent the character string that identifies this base station. The character string shall be included in the order of appearance. RESERVED Reserved bits. This field shall contain the number of bits required to make the entire AP_ID_TEXT field an integer number of octets in length. All bits of this field shall be set to zeros. SERVICE_CAP_INFO_INCLUDED Service Capability Information Included This field is set to 1 if SERVICE_CAP_INFO is included. Otherwise, it is set to 0. SERVICE_CAP_INFO Service Capability Information If SERVICE_CAP_INFO_INCLUDED is set to 1, the mobile station shall include this field; otherwise the mobile station shall omit this field. The value assignments of each bit in this field is defined in [4]. LAT_LONG_INCLUDED Latitude and Longitude Included This field is set to 1 if latitude and longitude information is included. Otherwise, it is set to 0. LATITUDE Latitude. If LAT_LONG_INCLUDED is set to 1, the mobile station shall include this field; otherwise the mobile station shall omit this field. Latitude of the center of the circle in units of 0.25 second, expressed as a twos complemented signed number with positive numbers signifying North latitudes. Values over the range of -1296000 to 1296000 inclusive (corresponding to a range of -90 to +90) are valid. Otherwise, this field is omitted. LONGITUDE Longitude. If LAT_LONG_INCLUDED is set to 1, the mobile station shall include this field; otherwise the mobile station shall omit this field. Longitude of the center of the circle in units of 0.25 second, expressed as a twos complemented signed number with positive numbers signifying East longitude. Values over the range of -2592000 to 2592000 inclusive (corresponding to a range of -180 to +180) are valid. Otherwise, this field is omitted. HEIGHT_INCLUDED Height Included This field is set to 1 if height information is included. Otherwise, it is set to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

3-173

3GPP2 C.S0016-D v2.0 HEIGHT Height. If HEIGHT_INCLUDED is set to 1, the mobile station shall include this field; otherwise the mobile station shall omit this field. This field is a twos complement signed value set to the height above the WGS-84 reference ellipsoid, in units of 1 meter, in the range from -500 m to 15883 m. Otherwise, this field is omitted. ACQ_TYPE Acquisition Type Set according to the following table. ACQ_TYPE Value 00000000 00000001 to 11111111
11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38

1 2 3 4 5 6 7 8 9 10

Description cdma2000 1x or HRPD Reserved

ACQ_INFO

Acquisition Information See Section 3.5.7.1.6.2 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based Acquisition Information.

ASSOCIATED_HRPD

Associated HRPD System. When the SYS_TYPE is set to cdma2000 1x and there is an associated HRPD system available it shall be set to the 31 bit field consisting of, in sequence, the UZ_ID and UZ_SID identifying the UZ of the associated HRPD system. When the SYS_TYPE is set to HRPD, this field is not included.

USE_ASSOCIATED_UZ_RF_GEO_INFO - Use the UZ information from the Associated System If this flag is set to '1' for an HRPD UZ (a UZ with a SYS_TYPE set to HRPD) with an associated system, the UZ_RF_TYPE and GEO_TYPE_SPECIFIC_FIELDS information of the associated system will be used. And the UZ_RF_TYPE and GEO_TYPE_SPECIFIC_FIELDS information shall not be provisioned in this HRPD UZ. If the flag is set to '0' for an HRPD_UZ, the UZ_RF_TYPE and GEO_TYPE_SPECIFIC_FIELDS information of the associated system are not used. And the UZ_RF_TYPE and GEO_TYPE_SPECIFIC_FIELDS information may be provisioned. For the associated 1x UZ (with a SYS_TYPE set to 1x), the flag is set to '0'. NUM_UZ_RF_TYPES Number of User Zone RF Types If UZ_INFO_FLAG is set to 0, then this field is set to 0. Otherwise, this field is set to the number of UZ_RF_TYPEs.

3-174

3GPP2 C.S0016-D v2.0 UZ_RF_TYPE User Zone RF Type The UZ RF Type describes the type of UZ RF information which can be used by a Mobile Station to determine when to scan for an AP. Set according to the following table. UZ_RF_TYPE Value 00000000 00000001 00000010 to 11111111
6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

1 2 3 4 5

Description 1x HRPD Reserved

UZ_RF_INFO

See Section 3.5.7.1.6.3 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based UZ RF Information. This fieldvalue is set GEO_TYPE_SPECIFIC_FIELDS. to the number of

NUM_GEO_TYPE_SPECIFIC FIELDS Number of Geo Type Specific Fields

GEO_TYPE_SPECIFIC_FIELDS - Geo Type specific fields. The GEO_TYPE_SPECIFIC_FIELDS describes geo-spatial information which can be used by a mobile station to determine if it should scan for an AP. One or more Geo Type specific fields (see 3.5.7.1.2). RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

22 23 24 25

3.5.7.1.6.1 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based System Information This section defines the Access Point System Information for User Zone Type 6 for the various system types.

3-175

3GPP2 C.S0016-D v2.0 3.5.7.1.6.1.1 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based System Information for 1x This section defines the Access Point System Information for User Zone Type 6 and SYS_TYPE = 00000000. Field MCC_INCLUDED MCC MNC_INCLUDED MNC SID_INCLUDED SID NID_INCLUDED NID_COUNT 1 12 or 0 1 12 or 0 1 15 or 0 1 6 or 0 Length (bits)

1 2 3 4 5

NID_COUNT occurrences of the following field: NID 16

MSC_CELL_ID_INCLUDED MSC_ID CELL_ID BASE_ID_INCLUDED BASE_ID_COUNT

1 24 or 0 16 or 0 1 8 or 0

BASE_ID_COUNT occurrences of the following field: BASE_ID 16

REG_ZONE_INCLUDED REG_ZONE RESERVED

6 7 8 9 10 11 12 13

1 8 or 0 0 to 7

MCC_INCLUDED

Mobile Country Code Included This field is set to 1 if MCC information is included. Otherwise, it is set to 0.

MCC

Mobile Country Code When the system type is a cdma2000 1x system, this field is set, using BCD encoding, to the three digit Mobile Country Code.

3-176

3GPP2 C.S0016-D v2.0 MNC_INCLUDED Mobile Network Code Included This field is set to 1 if MNC information is included. Otherwise, it is set to 0. MNC Mobile Network Code When the system type is a cdma2000 1x system, this field is set, using BCD encoding, to the two or three digit Mobile Network Code. If the length of the MNC is two digits, the least significant digit is encoded with 0xFF. For example, MNC=23 is set to 0x23F23F [31]. SID_INCLUDED System ID Included This field is set to 1 if SID is included. Otherwise, it is set to 0. SID System ID. If SID_INCLUDED = 1, this field is included and is set to the SID. Otherwise, this field is omitted. NID_INCLUDED NID Included This field is set to 1 if NID information is included. Otherwise, it is set to 0. NID_COUNT NID Count. If NID_INCLUDED is set to 1, then this field is set to the number of NIDs in the SID. Otherwise, this field is excluded. NID Network Identifier. If MSC_ID and CELL_ID are included, this field is set to 1 . Otherwise, it is set to 0. MSC_ID CELL_ID BASE_ID_INCLUDED MSC ID. Mobile Switching Center(s) (MSC). Cell ID. The sector(s) (CELL). BASE_ID Included. This field is set to 1 if BASE_ID is included. Otherwise, it is set to 0. BASE_ID_COUNT BASE_ID Count. If BASE_ID_INCLUDED is 0, this field shall not be included. Otherwise, this field is set to the count of BASE_IDs. BASE_ID BASE_ID. This field is set to the BASE_ID.. REG_ZONE_INCLUDED Registration Zone Included This field is set to 1 if Registration Zone information is included. Otherwise, it is set to 0. MSC_CELL_ID_INCLUDED - MSC_ID and CELL_ID Included.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

3-177

3GPP2 C.S0016-D v2.0 REG_ZONE Registration Zone. This field is set to the Registration Zone number of the base station [7]. RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

1 2 3 4 5 6 7 8 9

10 11 12 13

3.5.7.1.6.1.2 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based System Information for HRPD This section defines the system fields for SYS_TYPE=00000001 for HRPD. Field SUBNET_ID_COUNT 8 Length (bits)

SUBNET_ID_COUNT occurrences of the following threetwo fields: SUBNET_LENGTH SUBNET_ID RESERVED 8 SUBNET_LENGTH 0 to 7

RESERVED
14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

0 to 7

SUBNET_ID_COUNT SUBNET_LENGTH

SUBNET_ID Count. This field is set to the count of SUBNET_IDs. Subnet ID Length. This field specifies the length of the Subnet ID. The maximum Subnet_LENGTH is 128. The values '10000001' (129) to 11111111 (255) shall be reserved. Note: when the SUBNET_LENGTH is 128, the SUBNET_ID is equivalent to the SECTOR_ID.

SUBNET_ID RESERVED

Subnet ID. This field is set to the SUBNET_ID. Reserved bits. The mobile station shall add reserved bits as needed in order to make the combined length of SUBNET_LENGTH, SUBNET_ID and RESERVEDthis SYS_TYPEe entire parameter block equal to an integer number of octets. The base station shall set these bits shall be set to 0.

3-178

3GPP2 C.S0016-D v2.0

2 3 4

3.5.7.1.6.2 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based Acquisition Information This section describes the Access Point acquisition information. 3.5.7.1.6.2.1 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based Acquisition Information for 1x and HRPD This section defines the Access Point acquisition fields for ACQ_TYPE = 00000000 for 1x or HRPD. Field PN_INCLUDED PN_COUNT 1 8 or 0 Length (bits)

5 6 7 8

PN_COUNT occurrences of the following field: NGHBR_PN 9

BAND_CLASS_CHAN_INCLUDED BAND_CLASS_CHAN_NUM_COUNT

1 8 or 0

BAND_CLASS_CHAN_NUM_COUNT occurrences of the following two fields: BAND_CLASS CHANNEL_NUM 5 11

RESERVED
9 10 11 12 13 14 15 16 17 18 19 20 21

0 to 7

PN_INCLUDED

PN Included. If this field is set to 1, then PN information is included. Otherwise, it is excluded.

PN_COUNT

PN count. If PN_INCLUDED is 1, this field is set to the number of PN offsets. Otherwise, it is excluded.

NGHBR_PN

Neighbor PN offset. This field is set to the PN offset in units of 64 chips [7].

BAND_CLASS_CHAN_INCLUDED - Band Class Channel Included If this field is set to 1, the Band Class and Channel Number information is included. Otherwise, it is set to 0. BAND_CLASS_CHAN_NUM_COUNT - Band Class and Channel Number count.

3-179

3GPP2 C.S0016-D v2.0 If BAND_CLASS_CHAN_INCLUDED is 1, this field is set to the count of band classes and Channel Numbers. Otherwise, it is not included. BAND_CLASS CHANNEL_NUM Band class. This field is set to the Band Class as specified in [23]. Channel Number. This field is set to the channel number corresponding to the Band Class specified by this record. RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14

15 16 17

3.5.7.1.6.3 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based UZ RF Information This section describes the UZ information in terms of RF coverage.

3-180

3GPP2 C.S0016-D v2.0 3.5.7.1.6.3.1 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based UZ RF Information for 1x This section defines the UZ RF Info for UZ_RF_TYPE = 00000000 for 1x. NUM_ENTRIES { (NUM_ENTRIES) PN_OFFSET_INCL NUM_PN_OFFSET 1 3 or 0 4

1 2 3 4

NUM_ENTRIES occurrences of the following fields:

NUM_PN_OFFSET occurrences of the following field: PN_OFFSET 9

NUM_REG_ZONE

NUM_REG_ZONE occurrences of the following field: REG_ZONE 8

NUM_AP_ID

NUM_AP_ID occurrences of the following two fields: AP_ID_MASK_LENGTH AP_ID_MSB 8 AP_ID_MASK_LENGTH

UZ_NID_INCLUDED UZ_NID_COUNT

1 6 or 0

UZ_NID_COUNT occurrences of the following field: UZ_NID 16

UZ_BASE_ID_INCLUDED UZ_BASE_ID_COUNT

1 8 or 0

UZ_BASE_ID_COUNT occurrences of the following field: UZ_BASE_ID 16

RESERVED } (NUM_ENTRIES) RESERVED

5

0 to 7 0 to 7

3-181

3GPP2 C.S0016-D v2.0 NUM_ENTRIES Number of entries. This field is set to the number of UZ_NID_COUNT, UZ_NID, UZ_BASE_ID_COUNT, UZ_BASE_ID and Geo Type specific fields that follow. PN_OFFSET_INCL PN Offset Included. This field is set to 1 if the PN_OFFSET is included. Otherwise, it is set to 0. NUM_PN_OFFSET Number of PN Offsets. If PN_OFFSET_INCL is 1, then this field is set to the number of PN Offsets to be included. Otherwise, this field is omitted. PN_OFFSET PN offset. If PN_OFFSET_INCL is 1, then this field is set the PN offset of a base station or access point. Otherwise, this field is omitted. NUM_REG_ZONE REG_ZONE Number of Registration Zones. This field is set to the number of REG_ZONEs to be included. Registration Zone. This field is set to the Registration Zone number of the base station [7]. NUM_AP_ID AP_ID_MASK_LENGTH Number of Access Point Identifications This field is set to the number of AP_ID to be included. Access Point Identification Mask Length This field specifies the number of consecutive bits (starting from the most significant bit) of AP_ID which can identify a group of access points or a single access point. Note: when the AP_ID_MASK_LENGTH is equivalent to the full length of the AP_ID, the AP_ID_MSBS is equivalent to the AP_ID. The AP_ID_MASK_LENGTH may be broadcasted by a base-station in an overhead signaling message. This field may be set to 00000000 if no AP_ID_MSB is specified. AP_ID_MSB Access Point Identification Most Significant Bits. This field is set to most significant bits of AP ID limited to the length specified by AP_ID_MASK_LENGTH. The AP_ID may be broadcasted by a base-station in an overhead signaling message. UZ_NID_INCLUDED UZ NID Included. If this field is set to 1, UZ_NID Information is included. Otherwise, this field is set to 0. UZ_NID_COUNT User Zone NID Count If UZ_NID_INCLUDED is 1, this field is set to the count of the number of NIDs associated with the User Zone ID. Otherwise, it is not included.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

3-182

3GPP2 C.S0016-D v2.0 UZ_NID User Zone Network ID. The set of Network Identifiers (NID) associated with the User Zone ID. UZ_BASE_ID_INCLUDED UZ BASE ID Included. If this field is set to 1, UZ_BASE_ID Information is included. Otherwise, this field is set to 0. UZ_BASE_ID_COUNT User Zone BASE_ID Count. If UZ_BASE_ID_INCLUDED is 1, then this field is set to the count of the number of UZ_BASE_IDs fields associated with the User Zone ID. Otherwise, it is excluded. UZ_BASE_ID RESERVED User Zone Base ID. The BASE_ID associated with the User Zone ID. Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

3-183

3GPP2 C.S0016-D v2.0 3.5.7.1.6.3.2 User Zone Type 6: Mobile Specific RF Coverage and Geo-Based UZ RF Information for HRPD This section defines the UZ RF Info for UZ_RF_TYPE = 00000001 for HRPD. NUM_ENTRIES { (NUM_ENTRIES) PN_OFFSET_INCL NUM_PN_OFFSET 1 3 or 0 4

1 2 3 4

NUM_ENTRIES occurrences of the following fields:

NUM_PN_OFFSET occurrences of the following field: PN_OFFSET 9 or 0

NUM_AP_ID

NUM_AP_ID occurrences of the following two fields: AP_ID_MASK_LENGTH AP_ID_MSB 8 AP_ID_MASK_LENGTH

UZ_SUBNET_ID_INCLUDED UZ_ SUBNET_ID_COUNT

1 8 or 0

UZ_ SUBNET_ID_COUNT occurrences of the following two fields: UZ_SUBNET_LENGTH UZ_SUBNET_ID 8 SUBNET_LENGTH

RESERVED } (NUM_ENTRIES) RESERVED

5 6 7 8 9 10 11 12 13

0 to 7

0 to 7

NUM_ENTRIES

Number of entries. This field is set to the number of UZ_NID_COUNT, UZ_NID, UZ_BASE_ID_COUNT, UZ_BASE_ID and Geo Type specific fields that follow.

PN_OFFSET_INCL

PN Offset Included. This field is set to 1 if the PN_OFFSET is included. Otherwise, it is set to 0.

NUM_PN_OFFSET

Number of PN Offsets.

3-184

3GPP2 C.S0016-D v2.0 If PN_OFFSET_INCL is 1, then this field is set to the number of PN Offsets to be included. Otherwise, this field is omitted. PN_OFFSET PN offset. If PN_OFFSET_INCL is 1, then this field is set the PN offset of a base station or access point. Otherwise, this field is omitted. NUM_AP_ID AP_ID_LENGTH Number of AP_IDs This field is set to the number of AP_IDs to be included. Access Point Identification Length This field is set to the length of the access point identification (AP_ID) in units of 16 bits. The AP_ID_LENGTH may be broadcasted by a base-station in an overhead signaling message. AP_ID_MASK_LENGTH Access Point Identification Mask Length This field specifies the number of consecutive bits (starting from the most significant bit) of AP_ID which identifies a group of access points. Note: when the AP_ID_MASK_LENGTH is equivalent to the length of the AP_ID specified by AP_ID_LENGTH (48 bits), the AP_ID_MASK is equivalent to the AP_ID. The AP_ID_MASK_LENGTH may be broadcasted by a base-station in an overhead signaling message. This field may be set to 00000000 if no AP_ID_MSB is specified. AP_ID_MSB Access Point Identification Most Significant Bits Set to most significant bits of AP ID limited to the length specified by AP_ID_MASK_LENGTH. The AP_ID may be broadcasted by a base-station in an overhead signaling message. UZ_SUBNET_ID_INCLUDED - UZ SUBNET ID Included. If this field is set to 1, UZ_SUBNET_ID information is included. Otherwise, this field is set to 0. UZ_SUBNET_ID_COUNT User Zone SUBNET_ID Count If UZ_SUBNET_ID_INCLUDED is 1, then this field is set to the count of the number of UZSUBNET_LENGTH and UZ_SUBNET_IDs fields associated with the User Zone ID. Otherwise, it is excluded. UZ_SUBNET_LENGTH User Zone Subnet ID Length. This field specifies the length of the User Zone Subnet ID. The maximum UZ_SUBNET_LENGTH is 128. The values '10000001' (129) to 11111111 (255) shall be reserved. Note: when the UZ_SUBNET_LENGTH is 128, the UZ_SUBNET_ID is equivalent to the UZ_SECTOR_ID. UZ_SUBNET_ID RESERVED User Zone Subnet ID. The set of Subnet ID associated with the User Zone ID. Reserved bits.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43

3-185

3GPP2 C.S0016-D v2.0 The mobile station shall add reserved bits as needed in order to make the length of each entry (from PN_OFFSET_INCL to RESERVED inclusive)this UZ RF Infoe entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

1 2 3 4 5

3-186

3GPP2 C.S0016-D v2.0 3.5.8 3GPD Parameter Blocks Table 3.5.8-1 lists the types of parameter blocks used in the 3GPD Configuration Request Message and the 3GPD Configuration Response Message.

1 2 3 4 5

Table 3.5.8-1 3GPD Parameter Block Types Parameter Block Type 3GPD Operation Capability Parameters 3GPD Operation Mode Parameters SimpleIPSimple IP Capability Parameters MobileIPMobile IP Capability Parameters SimpleIPSimple IP User Profile Parameters Mobile IP User Profile Parameters SimpleIPSimple IP Status Parameters MobileIPMobile IP Status Parameters SimpleIPSimple IP PAP SS Parameters1 SimpleIPSimple IP CHAP SS Parameters1 MobileIPMobile IP SS Parameters1 HRPD Access Authentication Capability Parameters HRPD Access Authentication User Profile Parameters HRPD Access Authentication CHAP SS Parameters1 eHRPD AKA Algorithm Capability Parameters eHRPD MILENAGE Algorithm Parameters2 Reserved BLOCK_ID 00000000 00000001 00000010 00000011 00000100 00000101 00000110 00000111 00001000 00001001 00001010 00001011 00001100 00001101 00001110 00001111 00010000 through 11111111 Reference 3.5.8.1 3.5.8.2 3.5.8.3 3.5.8.4 3.5.8.5 3.5.8.6 3.5.8.7 3.5.8.8 3.5.8.9 3.5.8.10 3.5.8.11 3.5.8.12 3.5.8.13 3.5.8.14 3.5.8.15 3.5.8.16

The shared secret parameters shall not be transmitted over the air unencrypted.
1

The MILENAGE algorithm parameters shall not be transmitted over the air unencrypted.
2
6

3-187

3GPP2 C.S0016-D v2.0 3.5.8.1 3GPD Operation Capability Parameters The PARAM_DATA field of the 3GPD Operation Capability Parameters Block consists of the following fields:

1 2 3 4

Field OP_MODE
5 6 7 8 9 10

Length 8

OP_ MODE

Operation Mode Bitmap to indicate which operation modes are supported by the mobile station. The mobile station shall set this field to the value in the form of bitmap as follows:

Subfield SimpleIPSimple IP MobileIPMobile IP MobileIPMobile IP with SimpleIPSimple IP fallback Reserved

11 12 13 14 15 16 17 18 19 20

Length (bits) Subfield Description 1 1 1 SimpleIPSimple IP Supported MobileIPMobile IP Supported MobileIPMobile IP with SimpleIPSimple IP fallback Supported -

The Mobile Station shall set each subfield to 1, if the corresponding operating mode is supported by the mobile station; otherwise the mobile station shall set the subfield to 0.

RESERVED

Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set this field to 00000.

3-188

3GPP2 C.S0016-D v2.0 3.5.8.2 3GPD Operation Mode Parameters The PARAM_DATA field of the 3GPD Operation Mode Parameters Block consists of the following fields:

1 2 3 4

Field OP_MODE RESERVED

5 6 7 8 9 10

Length 2 6

OP_ MODE

Active operation mode in the mobile station. The mobile station shall set this field to the active operation mode in the mobile station as specified in Table 3.5.8.2-1.

Table 3.5.8.2-1 Operation Mode Operation Mode Binary Value

SimpleIPSimple IP only 00 MobileIPMobile IP with 01 SimpleIPSimple IP Fallback MobileIPMobile IP only RESERVED

11 12 13 14 15 16

10 11

RESERVED

Reserved bits. Additional reserved bits are needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set this field to 000000.

3-189

3GPP2 C.S0016-D v2.0 3.5.8.3 SimpleIPSimple IP Capability Parameters The PARAM_DATA field of the SimpleIPSimple IP Capability Parameters Block consists of the following fields:

1 2 3 4

Field MAX_NUM_NAI MAX_NAI_LENGTH MAX_SS_LENGTH AUTH_ALGORITHM RESERVED

5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

Length (bits) 4 8 5 8 7

MAX_NUM_NAI

Maximum SimpleIPSimple IP NAI Entries. The mobile station shall set this field to the maximum number of SimpleIPSimple IP NAI entries supported by the mobile station.

MAX_NAI_LENGTH

Maximum SimpleIPSimple IP NAI length. The mobile station shall set this field to the maximum length, in units of octets, of the SimpleIPSimple IP NAIs supported by the mobile station. The mobile station shall support an NAI length of at least 72 octets. If multiple authentication algorithms support is indicated, the mobile station shall set this field to the maximum of the NAI lengths allocated for the supported algorithms. The MAX_NAI_LENGTH shall be 72 octets or greater.9

MAX_SS_LENGTH

Maximum Length of the Shared Secret Data. The mobile station shall set this field to the maximum length, in units of octets, of the shared secret data supported by the mobile station. The mobile station shall support an SS length of at least 16 octets long. If multiple authentication algorithms support is indicated, the mobile station shall set this field to the maximum of the SS lengths allocated for the supported algorithms. The mobile station shall support an SS length of at least 16 octets long. The MAX_SS_LENGTH shall be 16 octets or greater.

AUTH_ALGORITHM

SimpleIPSimple IP Authentication Algorithm supported by the mobile station. The mobile station shall set this field to the SimpleIPSimple IP authentication algorithms supported by the mobile station in the form of bitmap. The Authentication Algorithm is encoded as follows:

9 Note that [35] states that The NAI is 72 octets max.

3-190

3GPP2 C.S0016-D v2.0

1 2

Table 3.5.8.3-1 AUTH_ALGORITHM Parameter Values Subfield PPP CHAP PPP_PAP RESERVED Length (bits) Subfield Description 1 1 6 CHAP mode-[11] PAP mode- [10]

3 4 5 6 7 8

RESERVED

Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set all bits of this field to 0.

9 10 11 12

3.5.8.4 MobileIPMobile IP Capability Parameters The PARAM_DATA field of the 3GPD MobileIPMobile IP Capability Parameters Block consists of the following fields:

Field MAX_NUM_NAI MAX_NAI_LENGTH MAX_MN-AAA_SS_LENGTH MN-AAA_AUTH_ALGORITHM MAX_MN-HA_SS_LENGTH MN-HA_AUTH_ALGORITHM RESERVED

13 14 15 16 17 18

Length (bits) 4 8 5 8 5 8 2

MAX_NUM_NAI

Maximum MobileIPMobile IP NAI Entries. The mobile station shall set this field to the maximum number of MobileIPMobile IP NAI entries supported by the mobile station.

MAX_NAI_LENGTH

Maximum MobileIPMobile IP NAI length.

3-191

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the maximum length, in units of octets, of the MobileIPMobile IP NAIs supported by the mobile station. The mobile station shall support an NAI length of at least 72 octets. If multiple authentication algorithms support is indicated, the mobile station shall set this field to the maximum of the NAI lengths allocated for the supported algorithms. The MAX_NAI_LENGTH shall be 72 octets or greater.10 MAX_MN-AAA_SS_LENGTH - Maximum Length of the Shared Secret Data (MN-AAA). The mobile station shall set this field to the maximum length, in units of octet, of the shared secret data (MN-AAA) supported by the mobile station. The mobile station shall support shared secret data of at least 16 octets long. If multiple authentication algorithms support is indicated, the mobile station shall set this field to the maximum of the MNAAA SS lengths allocated for the supported algorithms. The MAX_MN-AAA_SS_LENGTH shall be 16 octets or greater. MN-AAA_AUTH_ALGORITHM - Authentication Algorithm (MN-AAA) supported by the mobile station. The mobile station shall set this field to the MobileIPMobile IP authentication algorithms (MN-AAA) supported by the mobile station in the form of bitmap. The Authentication Algorithm is encoded as follows: Table 3.5.8.4-1 MN-AAA_AUTH_ALGORITHM Parameter Values

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

26

Subfield MD5 RESERVED

27 28 29 30 31 32 33 34 35 36

Length (bits) Subfield Description 1 7 [15]

MAX_MN-HA_SS_LENGTH

- Maximum Length of the Shared Secret Data (MN-HA). The mobile station shall set this field to the maximum length, in units of octet, of the shared secret data (MN-HA) supported by the mobile station. The mobile station shall set the shared secret data of at least 16 octets long. If multiple authentication algorithms support is indicated, the mobile station shall set this field to the maximum of the MN-HA SS lengths allocated for the supported algorithms. The MAX_MN-HA_SS_LENGTH shall be 16 octets or greater.

10 Note that [35] states that The NAI is 72 octets max.

3-192

3GPP2 C.S0016-D v2.0 MN-HA_AUTH_ALGORITHM - Authentication Algorithm (MN-HA) supported by the mobile station. The mobile station shall set this field to the MobileIPMobile IP authentication algorithms (MN-HA) supported by the mobile station in the form of bitmap. The Authentication Algorithm is encoded as follows: Table 3.5.8.4-2 MN-HA_AUTH_ALGORITHM Parameter Values

1 2 3 4 5 6 7 8

Subfield MD5 RESERVED

10 11 12 13 14 15

Length (bits) Subfield Description 1 7 [12]

RESERVED

Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set all bits of this field to 0.

16 17 18 19 20

3.5.8.5 SimpleIPSimple IP User Profile Parameters The PARAM_DATA field of the SimpleIPSimple IP User Profile Parameters Block consists of the following fields:

Field NUM_NAI 4

Length (bits)

NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX NAI_LENGTH NAI AUTH_ALGORITHM 4 8 8 NAI_LENGTH 4

RESERVED
21 22 23 24

0 to 7 (as needed)

NUM_NAI

Number of SimpleIPSimple IP NAI Entries. The mobile station shall set this field to the number of SimpleIPSimple IP NAI entries.

3-193

3GPP2 C.S0016-D v2.0 The mobile station shall include NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX SimpleIPSimple IP NAI entry index. The mobile station shall set this field to the index in the SimpleIPSimple IP NAI Table. NAI_LENGTH SimpleIPSimple IP NAI length. The mobile station shall set this field to the length of the NAI in units of octet. NAI Network Access Identifier. The mobile station shall set this field to the Network Access Identifier (NAI), encoded in ASCII string, refer to [14]. The NAI is of the form user@realm. AUTH_ALGORITHM Authentication Algorithm for SimpleIPSimple IP. The mobile station shall set this field to the authentication algorithm used to calculate the Simple IP Authentication. The Authentication Algorithm is specified in Table 3.5.8.5-1.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

Table 3.5.8.5-1 Authentication Algorithm Parameter Values for SimpleIPSimple IP AUTH_ALGORITHM None PPP CHAP PPP PAP PPP CHAP to PAP fallback RESERVED Binary Value 0000 0001 0010 0011 0100 to 1111

18 19 20 21 22 23

RESERVED

Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

3-194

3GPP2 C.S0016-D v2.0 3.5.8.6 Mobile IP User Profile Parameters The PARAM_DATA field of the Mobile IP User Profile Parameters Block consists of the following fields:

1 2 3 4

Field RETRY_INFO_INCLUDED MAX_NUM_RETRY FIRST_RETRY_TIMEOUT REREG_THRESHOLD NUM_NAI 1 0 or 2 0 or 3 0 or 6 4

Length (bits)

NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX NAI_LENGTH NAI T_BIT HOME_ADDRESS PRIMARY_HOME_AGENT 4 8 8 NAI_LENGTH 1 32 32

SECONDARY_HOME_AGENT 32 MN-AAA_AUTH_ALGORITHM 4 MN-AAA-SPI_INDICATOR MN-AAA_SPI MN-HA_AUTH_ALGORITHM MN-HA_SPI_INDICATOR MN-HA_SPI 1 0 or 32 4 1 0 or 32

RESERVED
5 6 7 8 9 10 11 12

0 to 7 (as needed)

RETRY_INFO_INCLUDED -

Indicate if the retry information is included or not. If MAX_NUM_RETRY, FIRST_RETRY_TIMEOUT and REREG_THRESHOLD are included in this block, the mobile station shall set this field to 1; otherwise, the mobile station shall set this field to 0.

MAX_NUM_RETRY

Maximum Number of Retry for the MobileIPMobile IP Registration.

3-195

3GPP2 C.S0016-D v2.0 If RETRY_INFO_INCLUDED is set to 0, the mobile station shall omit this field; otherwise, the mobile station shall set this field as follows: The mobile station shall set this field to the maximum number of retries for MobileIPMobile IP registration. FIRST_RETRY_TIMEOUT The amount of time elapsed between the first and second MobileIPMobile IP Registration Requests, while the mobile station did not receive the MobileIPMobile IP Registration Reply. If RETRY_INFO_INCLUDED is set to 0, this field shall be omitted; otherwise, this field shall be set as follows: This field shall be set to one less than the number of amount of time elapsed, in units of 250ms, between the first and second MobileIPMobile IP Registration Requests, while the mobile station did not receive the MobileIPMobile IP Registration Reply. REREG_THRESHOLD -Re-Registration Threshold. If RETRY_INFO_INCLUDED is set to 0, the mobile station shall omit this field; otherwise, the mobile station shall set this field as follows: The mobile station shall set this field to the time, in units of minute, before the expiration of the registration lifetime that the mobile will try to reregister. NUM_NAI Number of MobileIPMobile IP NAI Entries. The mobile station shall set this field to the number of MobileIPMobile IP NAI entries. The mobile station shall include NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX MobileIPMobile IP NAI entry index. The mobile station shall set this field to the index in the MobileIPMobile IP NAI Table. NAI_LENGTH MobileIPMobile IP NAI length. The mobile station shall set this field to the length of the MobileIPMobile IP NAI, in units of octet. NAI Network Access Identifier. The mobile station shall set this field to the Network Access Identifier (NAI), encoded in ASCII string, refer to [14]. The NAI is of the form user@realm. T_BIT Reverse Tunneling. The mobile station shall set this field to 1 if the reverse tunneling is required or set to 0 if reverse tunneling is not required, see [13]. HOME_ADDRESS Home Address. The mobile station shall set this field to the IP address of the mobile node in the form of network byte code. 3-196

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44

3GPP2 C.S0016-D v2.0 PRIMARY_HOME_AGENT Primary Home Agent. The mobile station shall set this field to the IP address of the mobile node's primary home agent in the form of network byte code. SECONDARY_HOME_AGENT - Secondary Home Agent. The mobile station shall set this field to the IP address of the mobile node's back-up/secondary home agent in the form of network byte code. MN-AAA_AUTH_ALGORITHM - Authentication Algorithm (MN-AAA) The mobile station shall set this field to the authentication algorithm used to calculate the Mobile IP MN-AAA Authentication Extension as defined in [15]. The Authentication Algorithm is encoded corresponding to Table 3.5.8.6-1.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

Table 3.5.8.6-1 Authentication Algorithm Parameter Values MN-AAA_AUTH_ALGORITHM/ MA-HA_AUTH_AlGORITHM None MD5 RESERVED 0000 0001 0010 to 1111 Binary Value

17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36

MN-AAA_SPI_INDICATOR -

Indicator of SPI between MN and AAA. The mobile station shall set this field to 1 if the Security Parameter Index is included; otherwise, the mobile station shall set this field to 0.

MN-AAA_SPI

SPI between MN and AAA. If the MN-AAA_SPI_INDICATOR field is set to 1, the mobile station shall set this field to the Security Parameter Index (MN-AAA); otherwise, the mobile station shall omit this field.

MN-HA_AUTH_ALGORITHM - Authentication Algorithm (MN-HA) The mobile station shall set this field to the authentication algorithm used to calculate the Mobile IP MN-HA Authentication Extension as defined in [12]. The Authentication Algorithm is encoded according to Table 3.5.8.6-1. MN-HA_SPI_INDICATOR Indicator of SPI between MN and HA. The mobile station shall set this field to 1 if Security Parameter Index is included; otherwise, the mobile station shall set this field to 0. MN-HA_SPI SPI between MN and HA.

3-197

3GPP2 C.S0016-D v2.0 If the MN-HA_SPI_INDICATOR field is set to 1, the mobile station shall set this field to the Security Parameter Index between MN and HA; otherwise, mobile station shall omit this field. RESERVED Reserved bits. Additional reserved bits are needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set these bits to 0. 3.5.8.7 SimpleIPSimple IP Status Parameters Field ACT_NAI_ENTRY_INDEX RESERVED
11 12 13 14

1 2 3 4 5 6 7 8

9 10

Length (bits) 4 4

ACT_NAI_ENTRY_INDEX -

Active SimpleIPSimple IP NAI entry index. The mobile station shall set this SimpleIPSimple IP NAI entry index. field to the active

15 16 17 18 19

RESERVED

Reserved bits. Additional reserved bits are needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set this field to 0000.

20 21

3.5.8.8 MobileIPMobile IP Status Parameters Field ACT_NAI_ENTRY_INDEX NUM_ADD_ACT_NAI 4 4 Length (bits)

NUM_ADD_ACT_NAI occurrences of the following field: ADD_ACT_NAI_ENTRY_INDEX 4

RESERVED
22 23 24 25

0 or 4 (as needed)

ACT_NAI_ENTRY_INDEX -

Active MobileIPMobile IP NAI entry index. The mobile station shall set this MobileIPMobile IP NAI entry index. field to the active

26

NUM_ADD_ACT_NAI

Number of additional Active MobileIPMobile IP NAI entries.

3-198

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the number of additional active MobileIPMobile IP NAI entries. ADD_ACT_NAI_ENTRY_INDEX - Additonal Active MobileIPMobile IP NAI entry index. The mobile station shall set this MobileIPMobile IP NAI entry index. RESERVED Reserved bits. Additional reserved bits are needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set this field to 0000. field to the active

1 2

3 4 5

6 7 8 9 10 11

12 13

3.5.8.9 SimpleIPSimple IP PAP SS Parameters

Field NUM_NAI 4

Length (bits)

NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX SS_LENGTH SS 4 5 8 SS_LENGTH

RESERVED
14

0 to 7 (as needed)

15 16 17 18 19 20 21 22 23 24 25 26

NUM_NAI

Number of SimpleIPSimple IP NAI Entries. The mobile station shall set this field to the number of SimpleIPSimple IP NAI entries.

The mobile station shall include NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX SimpleIPSimple IP NAI entry index. The mobile station shall set this field to the index in the SimpleIPSimple IP NAI Table. SS_LENGTH Shared Secret Data Length. The mobile station shall set this field to the length, in units of octet, of the shared secret data. The mobile station shall support the shared secret data of at least 16 octets long. SS Shared Secret Data.

3-199

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the Shared Secret Data. RESERVED Reserved bits. Additional reserved bits are needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set these bits to 0.

1 2 3 4 5 6 7

8 9

3.5.8.10 SimpleIPSimple IP CHAP SS Parameters

Field NUM_NAI 4

Length (bits)

NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX SS_LENGTH SS 4 5 8 SS_LENGTH

RESERVED
10

0 to 7 (as needed)

11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

NUM_NAI

Number of SimpleIPSimple IP NAI Entries. The mobile station shall set this field to the number of SimpleIPSimple IP NAI entries.

The mobile station shall include NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX SimpleIPSimple IP NAI entry index. The mobile station shall set this field to the index in the SimpleIPSimple IP NAI Table. SS_LENGTH Shared Secret Data Length. The mobile station shall set this field to the length, in units of octet, of the shared secret data. The mobile station shall support the shared secret data of at least 16 octets long. SS Shared Secret Data The mobile station shall set this field to the Shared Secret Data. RESERVED Reserved bits. Additional reserved bits are needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set these bits to 0.

3-200

3GPP2 C.S0016-D v2.0 3.5.8.11 MobileIPMobile IP SS Parameters

1 2

Field NUM_NAI 4

Length (bits)

NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX MN-AAA_SS_LENGTH MN-AAA_SS MN-HA_SS_LENGTH MN-HA_SS 4 5 8 MN-AAA_SS_LENGTH 5 8 MN-FA_SS_LENGTH

RESERVED
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

0 to 7 (as needed)

NUM_NAI

Number of MobileIPMobile IP NAI Entries. The mobile station shall set this field to the number of MobileIPMobile IP NAI entries.

The mobile station shall include NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX MobileIPMobile IP NAI entry index. The mobile station shall set this field to the index in the MobileIPMobile IP NAI Table. MN-AAA_SS_LENGTH Shared Secret Data Length between MN and AAA. The mobile station shall set this field to the length, in units of octet, of the shared secret data between MN and AAA. The mobile station shall support the shared secret data of at least 16 octets long. MN-AAA_SS Shared Secret Data between MN and AAA. The mobile station shall set this field to the Shared Secret Data between MN and AAA. MN-HA_SS_LENGTH Shared Secret Data Length between MN and HA. The mobile station shall set this field to the length, in units of octet, of the shared secret data. The mobile station shall support the shared secret data of at least 16 octets long. MN-HA_SS Shared Secret Data between MN and HA. The mobile station shall set this field to the Shared Secret Data between MN and HA. RESERVED Reserved bits.

3-201

3GPP2 C.S0016-D v2.0 Additional reserved bits are needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set these bits to 0. 3.5.8.12 HRPD Access Authentication Capability Parameters The PARAM_DATA field of the HRPD [9] Access Authentication Capability Parameters Block consists of the following fields:

1 2 3 4

5 6 7 8

Field MAX_NAI_LENGTH MAX_SS_LENGTH RESERVED AUTH_ALGORITHM

9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

Length (bits) 8 5 3 8

MAX_NAI_LENGTH

Maximum Access Authentication NAI length. The mobile station shall set this field to the maximum length, in units of octets, of the NAIs supported by the mobile station. The mobile station shall support an NAI length of at least 72 octets. If multiple authentication algorithms support is indicated, the mobile station shall set this field to the maximum of the NAI length allocated for the supported algorithms. The MAX_NAI_LENGTH shall be 72 octets or greater.11

MAX_SS_LENGTH

Maximum Length of the Shared Secret Data. The mobile station shall set this field to the maximum length, in units of octets, of the shared secret data supported by the mobile station. The mobile station shall support an SS length of at least 16 octets long. If multiple authentication algorithms support is indicated, the mobile station shall set this field to the maximum of the SS length allocated for the supported algorithms. The MAX_SS_LENGTH shall be 16 octets or greater.

RESERVED

Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set this field to 000.

AUTH_ALGORITHM

HRPD Access Authentication Algorithm supported by the mobile station.

11 Note that [35] states that The NAI is 72 octets max.

3-202

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the HRPD access authentication algorithms supported by the mobile station in the form of bitmap. The Authentication Algorithm is encoded as follows:

1 2 3 4 5 6

Table 3.5.8.12-1 AUTH_ALGORITHM Parameter Values Subfield PPP CHAP RESERVED Length (bits) Subfield Description 1 7 CHAP mode-[11]

7 8 9 10

The mobile station shall set each subfield to 1, if the corresponding authentication algorithm is supported by the mobile station; otherwise, the mobile station shall set the subfield to 0.

11 12 13 14

3.5.8.13 HRPD Access Authentication User Profile Parameters The PARAM_DATA field of the HRPD Access Authentication User Profile Parameters Block consists of the following fields:

Field NAI_LENGTH NAI AUTH_ALGORITHM RESERVED

15 16 17 18 19 20 21 22 23 24 25 26

Length (bits) 8 8 NAI_LENGTH 4 4

NAI_LENGTH

NAI length. The mobile station shall set this field to the length of the NAI in units of octet.

NAI

Network Access Identifier. The mobile station shall set this field to the Network Access Identifier (NAI), encoded in ASCII string, refer to [14]. The NAI is of the form user@realm.

AUTH_ALGORITHM

Authentication Algorithm for HRPD Access Authentication. The mobile station shall set this field to the authentication algorithm used to calculate the HRPD Access Authentication. The Authentication Algorithm is specified in Table 3.5.8.13-1.

3-203

3GPP2 C.S0016-D v2.0 Table 3.5.8.13-1 Authentication Algorithm Parameter Values AUTH_ALGORITHM None PPP CHAP RESERVED
2 3 4 5

Binary Value 0000 0001 0010 to 1111

RESERVED

Reserved bits. The mobile station shall set this field to 0000.

6 7

3.5.8.14 HRPD Access Authentication CHAP SS Parameters Field SS_LENGTH SS RESERVED 5 8 SS_LENGTH 3 Length (bits)

8 9 10 11 12 13 14 15 16 17 18 19

SS_LENGTH

Shared Secret Data Length. The mobile station shall set this field to the length, in units of octet, of the shared secret data. The mobile station shall support the shared secret data of at least 16 octets long.

SS

Shared Secret Data The mobile station shall set this field to the Shared Secret Data.

RESERVED

Reserved bits. Additional reserved bits are needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set these bits to 0.

3-204

3GPP2 C.S0016-D v2.0 3.5.8.15 eHRPD AKA Algorithm Capability Parameters The PARAM_DATA field of the eHRPD AKA Algorithm Capability Parameters Block consists of the following fields:

1 2 3 4

Field AKA_ALGORITHM
5 6 7 8 9 10 11

Length (bits) 8

AKA_ALGORITHM

eHRPD AKA authentication algorithms bitmap to indicate which AKA authentication algorithms are supported by the mobile station. The mobile station shall set this field to the value in the form of bitmap as follows:

Subfield MILENAGE RESERVED

12 13 14 15 16 17 18 19 20 21 22

Length (bits) Subfield Description 1 7 MILENAGE supported as specified in [29] -

The Mobile Station shall set each subfield to 1, if the corresponding operating mode is supported by the mobile station; otherwise the mobile station shall set the subfield to 0.

RESERVED

Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set this field to 0000000.

23 24

3.5.8.16 eHRPD MILENAGE Algorithm Parameters Field OP_PARAM_VALUE OP_PARAM_TYPE RESERVED 128 1 7 Length (bits)

25

3-205

3GPP2 C.S0016-D v2.0 OP_PARAM_VALUE OP_PARAM_TYPE 128-bit MILENAGE Operator Variant Algorithm Configuration Field (see to [29]). If this bit is 0, the mobile station shall treat OP_PARAM_VALUE as the OP parameter defined in [29]; otherwise, the mobile sation shall treat OP_PARAM_VALUE as the OPc parameter defined in [29]. Reserved bits. Additional reserved bits are needed in order to make the length of the entire parameter block equal to an integer number of octets. The mobile station shall set these bits to 0000000.

1 2 3 4 5 6 7 8 9 10 11

RESERVED

12

13 14 15 16 17

3.5.9 MMD Parameter Block Table 3.5.9-1 lists the types of parameter blocks used in the MMD Configuration Request Message and the MMD Configuration Response Message.

Table 3.5.9-1 MMD Parameter Block Types Parameter Block Type MMD Application Parameters Reserved BLOCK_ID 00000000 00000001 through 11111111 Reference 3.5.9.1

3-206

3GPP2 C.S0016-D v2.0

2 3 4 5

3.5.9.1 MMD Application Parameters The PARAM_DATA field of the MMD Application Parameters Block consists of the following fields: Field IMPI_LENGTH IMPI NUM_IMPU 8 8 IMPI_LENGTH 4 Length (bits)

NUM_IMPU occurrences of the following fields: IMPU_ENTRY_IDX IMPU_LENGTH IMPU 4 8 8 IMPU_LENGTH

SIP_URI_LENGTH SIP_DOMAIN_URI NUM_P-CSCF

8 8 SIP_URI_LENGTH 4

NUM_P-CSCF occurrences of the following fields: P-CSCF_ENTRY_IDX P-CSCF_LENGTH P-CSCF_ADDRESS 4 8 8 P-CSCF_LENGTH

RESERVED
6 7 8 9 10 11 12 13 14 15 16

0 to 7

IMPI_LENGTH

IMS Private Identity length The mobile station shall set this field to the length of the IMPI in units of octets

IMPI

IMS Private Identity. The mobile station shall set this field to the IMS Private Identity, encoded in ASCII string, refer to [17].

NUM_IMPU

Number of IMS Public Identity entries. The mobile station shall set this field to the number of IMS Public Identity entries.

The mobile station shall include NUM_IMPU occurrences of the following fields: IMPU_ENTRY_IDX IMPU entry index.

3-207

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the index in the IMPU Table. IMPU_LENGTH IMS Public Identity length. The mobile station shall set this field to the length of the IMPU in units of octet. IMPU IMS Public Identity. The mobile station shall set this field to the IMS Public Identity (IMPU), encoded in ASCII string, refer to [17]. SIP_URI_LENGTH SIP Domain URI length. The mobile station shall set this field to the length of the SIP Domain URI. SIP_DOMAIN_URI SIP Domain URI. The mobile station shall set this field to the SIP Domain URI, encoded in ASCII string, refer to [17]. NUM_P-CSCF Number of P-CSCF entries The mobile station shall set this field to the number of PCSCF entries. The mobile station shall include NUM_P-CSCF occurrences of the following fields: P-CSCF_ENTRY_IDX P-CSCF entry index. The mobile station shall set this field to the index in the PCSCF Table. P-CSCF_LENGTH P-CSCF length. The mobile station shall set this field to the length of the PCSCF in units of octet. P-CSCF_ADDRESS P-CSCF address. The mobile station shall set this field to the P-CSCF address, encoded in ASCII string, refer to [17] RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

3-208

3GPP2 C.S0016-D v2.0 3.5.10 System Tag Parameter Blocks Table 3.5.10-1 lists the types of parameter blocks used in the System Tag Configuration Request Message and the System Tag Configuration Response Message.

1 2 3 4 5

Table 3.5.10-1 System Tag Parameter Block Types System Tag Parameter Block Type Home System Tag Group Tag List Dimensions Group Tag List Specific Tag List Dimensions Specific Tag List Call Prompt List Dimensions Call Prompt List Reserved BLOCK_ID 00000000 00000001 00000010 00000011 00000100 00000101 00000110 00000111 through 11111111 Reference 3.5.10.1 3.5.10.2 3.5.10.3 3.5.10.4 3.5.10.5 3.5.10.6 3.5.10.7

7 8 9

3.5.10.1 Home System Tag The PARAM_DATA field of the Home System Tag Block consists of the following fields: Field CALL_PRMPT_INCL CALL_PRMPT RESERVED TAG_ENCODING TAG_LEN TAG 1 0 or 5 0 or 5 5 5 TAG_LEN 8 Length (bits)

10 11 12 13 14 15

CALL_PRMPT_INCL

Call Prompt Included Flag. The mobile station shall set this field to 1 if the CALL_PRMPT field is included in this parameter block. Otherwise, the mobile station shall set this field to 0

CALL_PRMPT

Call prompt identifier.

3-209

3GPP2 C.S0016-D v2.0 If a Call Prompt is associated with the Home System Tag, the mobile station shall set this field to the associated Call Prompt Identifier (see 3.5.10.4). Otherwise, this field shall be omitted. RESERVED Reserved bits. If CALL_PRMPT_INCL is set to 0, the mobile station shall set this field to 00000. Otherwise, this field shall be omitted. TAG_ENCODING Home system tag encoding. See [4]. This field shall be set to indicate the character set used in the TAG field included in this parameter block. TAG_LEN Length of home system tag. The mobile system shall set this field to the length of the home system tag in octets. TAG Home system tag. The mobile station shall set this field to characters based on the encoding method defined in TAG_ENCODING. 3.5.10.2 Group Tag List Dimensions The PARAM_DATA field of the Group Tag List Dimensions Block consists of the following fields: Field MAX_GROUP_TAG_LIST_SIZE CUR_GROUP_TAG_LIST_SIZE GROUP_TAG_LIST_ID CUR_TAG_P_REV NUM_GROUP_TAG_RECS
21 22 23 24 25 26 27 28 29 30 31 32 33

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

17 18 19 20

Length (bits) 16 16 16 8 8

MAX_GROUP_TAG_LIST_SIZE

Maximum group system tag list size.

The mobile station shall set this field to the maximum size, in octets, that the mobile station can support for the group system tag list (GROUP_TAG_LISTs-p). CUR_GROUP_TAG_LIST_SIZE Current group system tag list size. The mobile station shall set this field to the size, in octets, of the current group system tag list. GROUP_TAG_LIST_ID Group System Tag List Identification. The mobile station shall set this field to the value of the Group System Tag List Identification assigned for the group system tag indicator list (GROUP_TAG_LISTs-p) by the base station.

3-210

3GPP2 C.S0016-D v2.0 CUR_TAG_P_REV Protocol revision of the mobile stations current group tag list. The mobile station shall set this field to the value of the TAG_P_REV associated with its current group tag list. NUM_GROUP_TAG_RECS Number of Group System Tag Records. The mobile station shall set this field to the number of group system tag records contained within the GROUP_TAG_TABLE field of the current group tag list. 3.5.10.3 Group Tag List Parameter Block The PARAM_DATA field of the Group Tag List Block consists of the following fields: Field CUR_TAG_P_REV RESERVED LAST_SEGMENT SEGMENT_OFFSET SEGMENT_SIZE SEGMENT_DATA
11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

1 2 3 4 5 6 7

8 9 10

Length (bits) 8 7 1 16 8 SEGMENT_SIZE 8

CUR_TAG_P_REV

Protocol revision for the system tag. This field is used to specify the format of the rest of the System Tag. The mobile station shall set this field to the value of the TAG_P_REV associated with its current group tag list.

RESERVED LAST_SEGMENT

Reserved bits. The mobile station shall set this field to 0000000. Last segment indicator bit. The mobile station shall set this field to 1 if SEGMENT_DATA contains the last octet of the group tag list; otherwise, the mobile station shall set this field to 0.

SEGMENT_OFFSET

Segment offset. The mobile station shall set this field to the value of REQUEST_OFFSET from the corresponding System Tag Configuration Request Message.

SEGMENT_SIZE

Segment size. The mobile station shall set this field to the number of octets of the group tag list included in SEGMENT_DATA.

3-211

3GPP2 C.S0016-D v2.0 If REQUEST_OFFSET from the corresponding System Tag Configuration Request Message specifies an offset that is invalid for the current group tag list, the mobile station shall set this field to '0000 0000' and shall include no octets in the SEGMENT_DATA field. If REQUEST_OFFSET specifies an offset that is valid for the current group tag list, the mobile station shall include at most REQUEST_MAX_SIZE sequential octets of the group tag list in the SEGMENT_DATA field. SEGMENT_DATA Segment of the group tag list data. If REQUEST_OFFSET from the corresponding System Tag Configuration Request Message specifies an offset that is invalid for the current group tag list, the mobile station shall include no octets in this field. If REQUEST_OFFSET specifies an offset that is valid for the current group tag list, the mobile station shall include at most REQUEST_MAX_SIZE sequential octets of the group tag list in this field. This field contains SEGMENT_SIZEThe octets shall be equal to the octets starting at the offset specified by SEGMENT_OFFSET within the group tag list specified by SEGMENT_OFFSET. 3.5.10.4 Specific Tag List Dimensions The PARAM_DATA field of the Specific Tag List Dimensions Block consists of the following fields: Field MAX_SPEC_TAG_LIST_SIZE CUR_SPEC_TAG_LIST_SIZE SPEC_TAG_LIST_ID CUR_TAG_P_REV NUM_SPEC_TAG_RECS RESERVED
26 27 28 29 30 31 32 33 34

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

22 23 24 25

Length (bits) 16 16 16 8 14 2

MAX_SPEC_TAG_LIST_SIZE -

Maximum specific system tag list size.

The mobile station shall set this field to the maximum size, in octets, that the mobile station can support for the specific system tag list (SPEC_TAG_LISTs-p). CUR_SPEC_TAG_LIST_SIZE Current specific system tag list size. The mobile station shall set this field to the size, in octets, of the current specific system tag list. SPEC_TAG_LIST_ID Specific System Tag List Identification.

3-212

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the value of the Specific System Tag List Identification assigned for the specific system tag indicator list (SPEC_TAG_LISTs-p) by the base station. CUR_TAG_P_REV Protocol revision of the mobile stations current group tag list. The mobile station shall set this field to the value of the TAG_P_REV associated with its current specific tag list. NUM_SPEC_TAG_RECS Number of Specific System Tag Records. The mobile station shall set this field to the number of specific system tag records contained within its SPEC_TAG_TABLE field of the current specific tag list RESERVED Reserved bits. The mobile station shall set this field to 00. 3.5.10.5 Specific Tag List Parameter Block The PARAM_DATA field of the Specific Tag List Block consists of the following fields: Field CUR_TAG_P_REV RESERVED LAST_SEGMENT SEGMENT_OFFSET SEGMENT_SIZE SEGMENT_DATA
17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

1 2 3 4 5 6 7 8 9 10 11 12 13

14 15 16

Length (bits) 8 7 1 16 8 SEGMENT_SIZE 8

CUR_TAG_P_REV

Protocol revision for the system tag. This field is used to specify the format of the rest of the System Tag. The mobile station shall set this field to the value of the TAG_P_REV associated with its current specific tag list.

RESERVED LAST_SEGMENT

Reserved bits. The mobile station shall set this field to 0000000. Last segment indicator bit. The mobile station shall set this field to 1 if SEGMENT_DATA contains the last octet of the specific tag list; otherwise, the mobile station shall set this field to 0.

SEGMENT_OFFSET

Segment offset. The mobile station shall set this field to the value of REQUEST_OFFSET from the corresponding System Tag Configuration Request Message.

SEGMENT_SIZE

Segment size.

3-213

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the number of octets of the specific tag list included in SEGMENT_DATA. If REQUEST_OFFSET from the corresponding System Tag Configuration Request Message specifies an offset that is invalid for the current specific tag list, the mobile station shall set this field to '0000 0000' and shall include no octets in the SEGMENT_DATA field. If REQUEST_OFFSET specifies an offset that is valid for the current specific tag list, the mobile station shall include at most REQUEST_MAX_SIZE sequential octets of the specific tag list in the SEGMENT_DATA field. SEGMENT_DATA Segment of the specific tag list data. If REQUEST_OFFSET from the corresponding System Tag Configuration Request Message specifies an offset that is invalid for the current specific tag list, the mobile station shall include no octets in this field. If REQUEST_OFFSET specifies an offset that is valid for the current specific tag list, the mobile station shall include at most REQUEST_MAX_SIZE sequential octets of the specific tag list in this field.This field contains SEGMENT_SIZE The octets shall be equal to the octets starting at the offset specified by SEGMENT_OFFSET within the specific tag list specified by SEGMENT_OFFSET.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

24

25 26 27 28

3.5.10.6 Call Prompt List Dimensions The PARAM_DATA field of the Call Prompt List Dimensions Block consists of the following fields: Field MAX_CALL_PRMPT_LIST_SIZE CUR_CALL_PRMPT_LIST_SIZE CALL_PRMPT_LIST_ID CUR_TAG_P_REV NUM_CALL_PRMPT_RECS 16 16 16 8 8 Length (bits)

29 30 31 32 33 34

MAX_CALL_PRMPT_LIST_SIZE

Maximum call prompt list size.

The mobile station shall set this field to the maximum size, in octets, that the mobile station can support for the call prompt list (CALL_PRMPT_LISTs-p). CUR_CALL_PRMPT_LIST_SIZE Current call prompt list size.

3-214

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the size, in octets, of the current call prompt list. CALL_PRMPT_LIST_ID Call Prompt List Identification. The mobile station shall set this field to the value of the Call Prompt List Identification assigned for the call prompt list (CALL_PRMPT_LISTs-p) by the base station. CUR_TAG_P_REV Protocol revision for the system tag. The mobile station shall set this field to the value of the TAG_P_REV associated with its current call prompt list. NUM_CALL_PRMPT_RECS Number of Call Prompt Records. The mobile station shall set this field to the number of call prompt records contained within its CALL_PRMPT_TABLE field of the call prompt list 3.5.10.7 Call Prompt Tag List Parameter Block The PARAM_DATA field of the Call Prompt List Block consists of the following fields: Field TAG_P_REV RESERVED LAST_SEGMENT SEGMENT_OFFSET SEGMENT_SIZE SEGMENT_DATA
17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

1 2 3 4 5 6 7 8 9 10 11 12 13

14 15 16

Length (bits) 8 7 1 16 8 SEGMENT_SIZE 8

CUR_TAG_P_REV

Protocol revision for the system tag. This field is used to specify the format of the rest of the System Tag. The mobile station shall set this field to the value of the TAG_P_REV associated with its current specific tag list.

RESERVED LAST_SEGMENT

Reserved bits. The mobile station shall set this field to 0000000. Last segment indicator bit. The mobile station shall set this field to 1 if SEGMENT_DATA contains the last octet of the call prompt list; otherwise, the mobile station shall set this field to 0.

SEGMENT_OFFSET

Segment offset. The mobile station shall set this field to the value of REQUEST_OFFSET from the corresponding System Tag Configuration Request Message.

SEGMENT_SIZE

Segment size.

3-215

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the number of octets of the call prompt list included in SEGMENT_DATA. If REQUEST_OFFSET from the corresponding System Tag Configuration Request Message specifies an offset that is invalid for the current call prompt list, the mobile station shall set this field to '0000 0000' and shall include no octets in the SEGMENT_DATA field. If REQUEST_OFFSET specifies an offset that is valid for the current call prompt list, the mobile station shall include at most REQUEST_MAX_SIZE sequential octets of the call prompt list in the SEGMENT_DATA field. SEGMENT_DATA Segment of the group tag list data. If REQUEST_OFFSET from the corresponding System Tag Configuration Request Message specifies an offset that is invalid for the current call prompt list, the mobile station shall include no octets in this field. If REQUEST_OFFSET specifies an offset that is valid for the current call prompt list, the mobile station shall include at most REQUEST_MAX_SIZE sequential octets of the call prompt list in this field. This field contains SEGMENT_SIZEThe octets shall be equal to the octets starting at the offset specified by SEGMENT_OFFSET within the call prompt list specified by SEGMENT_OFFSET. 3.5.11 Group Tag List, Specific Tag List and Call Prompt List The group tag list (GROUP_TAG_LISTs-p) and the specific tag list (SPEC_TAG_LISTs-p) contain information to be displayed on the mobile station when the mobile station is obtaining a service in the roaming network. These information can be associated with some parameters in the system record in the preferred roaming list. The Group Tag List is associated with TAG_P_REV equal to 00000001 and following variable length format: Group Tag List Field GROUP_TAG_LIST_SIZE GROUP_TAG_LIST_ID TAG_P_REV DEF_TAG_ENCODING NUM_GROUP_TAG_RECS GROUP_TAG_TABLE GROUP_TAG_CRC
32 33

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

24 25 26 27 28 29 30 31

has the

Length (bits) 16 16 8 8 8 variable 16

GROUP_TAG_LIST_SIZE -

Group tag list size.

3-216

3GPP2 C.S0016-D v2.0 This field is set to the total size, in octets, of the group tag list, including the GROUP_TAG_LIST_SIZE and GROUP_TAG_LIST_CRC fields. GROUP_TAG_LIST_ID Group Tag List Identification. The mobile station shall set this field to the value of the Group Tag List Identification assigned for the group tag list (GROUP_TAG_LISTs-p) by the base station. TAG_P_REV Protocol revision of the Group Tag format. This field is set to the value of the TAG_P_REV corresponding this group tag list (GROUP_TAG_LISTs-p) structure. This field determines the parsing rules for the Group Tag List. The base station shall set this field to 00000001 for this Group Tag List structure. DEF_TAG_ENCODING Default tag encoding. This field is set to the tag encoding method the mobile station is to use when operating on group tags not specified in GROUP_TAG_TABLE. NUM_GROUP_TAG_RECS Number of group tag records. This field is set to the number of group tag records contained in GROUP_TAG_TABLE (see Table 3.5.10.2-1). GROUP_TAG_TABLE Group Tag Table. This field contains the Group Tag Records. The number of group tag records is specified by NUM_GROUP_TAG_RECS. The group tag record formats are specified in 3.5.10.2.1. GROUP_TAG_LIST_CRC CRC for group tag list. This field is set to the 16-bit CRC calculated according to 3.5.11.13.5.10.1. The Specific Tag List is associated with TAG_P_REV equal to 00000001 and has the following variable length format: Specific Tag List Field SPEC_TAG_LIST_SIZE SPEC_TAG_LIST_ID TAG_P_REV DEF_TAG_ENCODING NUM_SPEC_TAG_RECS RESERVED SPEC_TAG_TABLE SPEC_TAG_CRC
31

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

Length (bits) 16 16 8 8 14 2 variable 16

3-217

3GPP2 C.S0016-D v2.0 SPEC_TAG_LIST_SIZE Specific tag list size. This field is set to the total size, in octets, of the specific tag list, including the SPEC_TAG_LIST_SIZE and SPEC_TAG_LIST_CRC fields. SPEC_TAG_LIST_ID Specific Tag List Identification. The mobile station shall set this field to the value of the Specific Tag List Identification assigned for the specific tag list (SPEC_TAG_LISTs-p) by the base station. TAG_P_REV Protocol revision of the Specific Tag format. This field is set to the value of the TAG_P_REV corresponding this specific tag list (SPEC_TAG_LISTs-p) structure. This field determines the parsing rules for the Specific Tag List. The base station shall set this field to 00000001 for this Specific Tag List structure. DEF_TAG_ENCODING Default tag encoding. This field is set to the tag encoding method the mobile station is to use when operating on specific tags not specified in SPEC_TAG_TABLE. NUM_SPEC_TAG_RECS Number of specific tag records. This field is set to the number of specific tag records contained in SPEC_TAG_TABLE (see Table 3.5.10.3-1). RESERVED SPEC_TAG_TABLE Reserved bits. This field shall be set to 00. Specific Tag Table. This field contains the Specific Tag Records. The number of specific tag records is specified by NUM_SPEC_TAG_RECS. The specific tag record formats are specified in 3.5.10.3.1. SPEC_TAG_LIST_CRC CRC for group tag list. This field is set to the 16-bit CRC calculated according to 3.5.11.13.5.10.1. The Call Prompt List is associated with TAG_P_REV equal to 00000001 and has the following variable length format:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

3-218

3GPP2 C.S0016-D v2.0

Call Prompt List Field CALL_PRMPT_LIST_SIZE CALL_PRMPT_LIST_ID TAG_P_REV DEF_TAG_ENCODING NUM_CALL_PRMPT_RECS RESERVED CALL_PRMPT_TABLE CALL_PRMPT_CRC
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

Length (bits) 16 16 8 8 14 2 variable 16

CALL_PRMPT_LIST_SIZE -

Call prompt list size. This field is set to the total size, in octets, of the specific tag list, including the CALL_PRMPT_LIST_SIZE and CALL_PRMPT_LIST_CRC fields.

CALL_PRMPT_LIST_ID

Call Prompt List Identification. The mobile station shall set this field to the value of the Call Prompt List Identification assigned for the call prompt list (CALL_PRMPT_LISTs-p) by the base station.

TAG_P_REV

Protocol revision of the Call Prompt format. This field is set to the value of the TAG_P_REV corresponding this call prompt list (CALL_PRMPT_LISTs-p) structure. This field determines the parsing rules for the Call Prompt List. The base station shall set this field to 00000001 for this Call Prompt List structure.

DEF_TAG_ENCODING

Default tag encoding. This field is set to the tag encoding method the mobile station is to use when operating on call prompts not specified in CALL_PRMPT_TABLE.

NUM_CALL_PRMPT_RECS

Number of call prompt records.

This field is set to the number of call prompt records contained in CALL_PRMPT_TABLE (see Table 3.5.10.3-1). RESERVED CALL_PRMPT_TABLE Reserved bits. This field shall be set to 00. Call Prompt Table. This field contains the Call Prompt Records. The number of call prompt records is specified by NUM_CALL_PRMPT_RECS. The call prompt record formats are specified in 3.5.10.3.1. CALL_PRMPT_LIST_CRC CRC for call prompt list.

3-219

3GPP2 C.S0016-D v2.0 This field is set to the 16-bit CRC calculated according to 3.5.11.13.5.10.1. 3.5.11.1 Group Tag List, Specific Tag List, and Call Prompt List CRC Calculation The 16-bit group tag list, specific tag list, and call prompt list CRC fields (GROUP_TAG_LIST_CRC, SPEC_TAG_LIST_CRC, CALL_PRMPT_LIST_CRC, respectively) are calculated on all bits of the Group Tag List, Specific Tag List, or Call Prompt List (as appropriate) excluding the bits of the GROUP_TAG_LIST_CRC, SPEC_TAG_LIST_CRC, and CALL_PRMPT_LIST_CRC fields. The generator polynomial for this CRC is 16 12 5 0 g(x) = x +x +x +x . The 16-bit CRC is calculated according to the following procedure using the logic shown in Figure 2.2.1-2: Initially, all shift register elements are set to logical one and the switches are set in the position A. The register is clocked with each preferred roaming list bit as an input, from the most significant bit of the GROUP_TAG_LIST_SIZE/SPEC_TAG_LIST_SIZE/CALL_PRMPT_LIST_SIZE field through the least significant bit of the GROUP_TAG_TABLE/SPEC_TAG_TABLE/CALL_PRMPT_TABLE field. The switches are set in the position B, and the register is clocked an additional 16 times. The 16 additional output bits constitute the CRC.

1 2

3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

21 22 23 24 25 26

3.5.11.2 Group Tag Records A group tag record contains parameters that the mobile station can use to display a system tag. Each type of group tag record is tailored for use in determining a particular system tag.

Table 3.5.11.2-1 Group Tag Record Type Values Acquisition Record Type Group Tag Record Single Entry Group Tag Record Range Reserved 000 001 010 - 111 Value

27

28

3.5.11.2.1 Group Tag Record Format 3.5.11.2.1.1 Group Tag Record Single Entry This group tag record type is for use in displaying a system tag in associated with a roaming indicator in the system record of the preferred roaming list, and has the following variable length format:

29 30 31 32

3-220

3GPP2 C.S0016-D v2.0

Group Tag Record Field GROUP_TAG_TYPE (000) ROAM_DISP_IND ENCODING_INCL TAG_ENCODING ROAM_IND CALL_PRMPT_INCL CALL_PRMPT TAG_LEN TAG RESERVED
2 3 4 5 6 7 8 9

Length (bits) 3 4 1 0 or 5 8 1 0 or 5 5 TAG_LEN 8 0, 2 or 5

GROUP_TAG_TYPE ROAM_DISP_IND

Group tag record type. This field is set to 000 (see Table 3.5.10.2-1). Roaming display indicator. The mobile station shall set this field to the value of the action for displaying the default roaming indicator on the mobile stations display. The values are: ROAM_DISP_IND 0000 0001 0010 0011 1111 Action Default Roaming Indicator off. Default Roaming indicator on. Default Roaming Indicator flashing. Reserved

10 11 12 13 14 15 16 17 18 19 20

ENCODING_INCL

Tag encoding field included flag. The mobile station shall set this field to 1 if the TAG_ENCODING field is included. Otherwise, the mobile station shall set this field to 0.

TAG_ENCODING

Group tag encoding format. See [4]. This field shall be set to indicate the character set used in the TAG field included in this parameter block.

ROAM_IND

Roaming indicator The mobile station shall set this field to the roaming indicator value (see [4]) for which this Group Tag Record is associated.

3-221

3GPP2 C.S0016-D v2.0 CALL_PRMPT_INCL Call Prompt Included Flag The mobile station shall set this field to 1 if the CALL_PRMPT field is included in this parameter block. Otherwise, the mobile station shall set this field to 0 CALL_PRMPT Call prompt identifier If a Call Prompt is associated with the Home System Tag, the mobile station shall set this field to the associated Call Prompt Identifier (see 3.5.10.4). Otherwise, this field shall be omitted. TAG_LEN Group tag length indicator. The mobile station shall set this field to the number of octets in the TAG field. TAG Group tag. The mobile station shall set this field to characters based on the encoding method defined in TAG_ENCODING. RESERVED Reserved bits. The mobile station shall set this field to 00 if ENCODING_INCL = 0 and CALL_PRMPT_INCL = 0. The mobile station shall set this field to 00000 if either ENCODING_INCL = 1 or CALL_PRMPT_INCL = 1. If ENCODING_INCL = 1 and CALL_PRMPT = 1, this field shall be omitted. 3.5.11.2.1.2 Group Tag Record Range This group tag record type is for use in displaying a system tag in associated with roaming indicators in the system records of the preferred roaming list, and has the following variable length format:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

23 24 25 26 27

3-222

3GPP2 C.S0016-D v2.0

Group Tag Record Field GROUP_TAG_TYPE (000) ROAM_DISP_IND ENCODING_INCL TAG_ENCODING CALL_PRMPT_INCL CALL_PRMPT LOW_ROAM_IND HIGH_ROAM_IND ROAM_INC TAG_LEN TAG RESERVED
1 2 3 4 5 6 7 8

Length (bits) 3 4 1 0 or 5 1 0 or 5 8 8 3 5 TAG_LEN 8 2, 5 or 7

GROUP_TAG_TYPE ROAM_DISP_IND

Group tag record type. This field is set to 000 (see Table 3.5.10.2-1). Roaming display indicator. The mobile station shall set this field to the value of the action for displaying the default roaming indicator on the mobile stations display. The values are: ROAM_DISP_IND 0000 0001 0010 0011 1111 Action Default Roaming Indicator off. Default Roaming indicator on. Default Roaming Indicator flashing. Reserved

9 10 11 12 13 14 15 16 17

ENCODING_INCL

Tag encoding field included flag. The mobile station shall set this field to 1 if the TAG_ENCODING field is included. Otherwise, the mobile station shall set this field to 0.

TAG_ENCODING

Group tag encoding format. See [4]. This field shall be set to indicate the character set used in the TAG field included in this parameter block.

CALL_PRMPT_INCL

Call Prompt Included Flag

3-223

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to 1 if the CALL_PRMPT field is included in this parameter block. Otherwise, the mobile station shall set this field to 0 CALL_PRMPT Call prompt identifier If a Call Prompt is associated with the Home System Tag, the mobile station shall set this field to the associated Call Prompt Identifier (see 3.5.10.4). Otherwise, this field shall be omitted. LOW_ROAM_IND Low roaming indicator The mobile station shall set this field to the roaming indicator (ROAM_IND, see [4]) having the lowest value over the range of ROAM_IND values for which this Group Tag Record is associated. HIGH_ROAM_IND High roaming indicator The mobile station shall set this field to the roaming indicator (ROAM_IND, see [4]) having the highest value over the range of ROAM_IND values for which this Group Tag Record is associated. ROAM_INC Roaming indicator increment The mobile station shall set this field to the increment used to construct the set of ROAM_INDs associated with this record. ROAM_INDs associated with this record are multiples of this value between LOW_ROAM_IND and HIGH_ROAM_IND inclusive. This field shall be set to a value in the range 1 to 7 inclusive. TAG_LEN Group tag length indicator. The mobile station shall set this field to the number of octets in the TAG field. TAG Group tag. The mobile station shall set this field to characters based on the encoding method defined in TAG_ENCODING. RESERVED Reserved bits. The mobile station shall set this field to 00 if either ENCODING_INCL = 1 or CALL_PRMPT_INCL = 1. If ENCODING_INCL = 1 and CALL_PRMPT_INCL = 1, the mobile station shall set this field to 00000. If ENCODING_INCL = 0 and CALL_PRMPT_INCL = 0, the mobile station shall set this field to 0000000.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39

40 41 42 43

3.5.11.3 Specific Tag Records A specific tag record contains parameters that the mobile station can use to display a system tag. Each type of group tag record is tailored for use in determining a particular system tag.

3-224

3GPP2 C.S0016-D v2.0

1 2

Table 3.5.11.3-1 Specific Tag Record Type Values Acquisition Record Type Specific Tag Record Single Entry Specific Tag Record Range Reserved 000 001 010 - 111 Value

3.5.11.3.1 Specific Tag Record Format 3.5.11.3.1.1 Specific Tag Record Single Entry This specific tag record type is for use in displaying a system tag in associated with a SID in the system record of the preferred roaming list, and has the following variable length format: Specific Tag Record Field SPEC_TAG_TYPE (000) ROAM_DISP_IND ENCODING_INCL TAG_ENCODING CALL_PRMPT_INCL CALL_PRMPT SID TAG_LEN TAG RESERVED 3 4 1 0 or 5 1 0 or 5 15 5 TAG_LEN 8 1, 3 or 6 Length (bits)

5 6 7 8 9

10 11 12 13 14 15 16 17

SPEC_TAG_TYPE ROAM_DISP_IND

Specific tag record type. This field is set to 000 (see Table 3.5.10.2-1). Roaming display indicator. The mobile station shall set this field to the value of the action for displaying the default roaming indicator on the mobile stations display. The values are: ROAM_DISP_IND 0000 Action Default Roaming Indicator off.

3-225

3GPP2 C.S0016-D v2.0

0001 0010 0011 1111

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

Default Roaming indicator on. Default Roaming Indicator flashing. Reserved

ENCODING_INCL

Tag encoding indicator flag. The mobile station shall set this field to 1 if the TAG_ENCODING field is included. Otherwise, the mobile station shall set this field to 0.

TAG_ENCODING

Tag encoding format. See [4]. This field shall be set to indicate the character set used in the TAG field included in this parameter block.

CALL_PRMPT_INCL

Call Prompt Included Flag The mobile station shall set this field to 1 if the CALL_PRMPT field is included in this parameter block. Otherwise, the mobile station shall set this field to 0

CALL_PRMPT

Call prompt identifier If a Call Prompt is associated with the Home System Tag, the mobile station shall set this field to the associated Call Prompt Identifier (see 3.5.10.4). Otherwise, this field shall be omitted.

SID

System Identification The mobile station shall set this field to the System Identification (SID) corresponding to this Specific Tag Record. (See [7]).

TAG_LEN

Tag length The mobile station shall set this field to the number of octets in the TAG field.

TAG

Specific Tag. The mobile station shall set this field to characters based on the encoding method defined in TAG_ENCODING.

RESERVED

Reserved bits. The mobile station shall set this field to 0 if ENCODING_INCL = 1 and CALL_PRMPT_INCL = 1. The mobile station shall set this field to 000 if ENCODING_INCL = 0 and CALL_PRMPT_INCL = 0. Otherwise, the mobile station shall set this field to 000000.

34 35 36 37

3.5.11.3.1.2 Specific Tag Record Range This specific tag record type is for use in displaying a system tag in associated with SIDs in the system records of the preferred roaming list, and has the following variable length format:

3-226

3GPP2 C.S0016-D v2.0

Specific Tag Record Field SPEC_TAG_TYPE (000) ROAM_DISP_IND ENCODING_INCL TAG_ENCODING CALL_PRMPT_INCL CALL_PRMPT LOW_SID HIGH_SID SID_INC TAG_LEN TAG RESERVED
2 3 4 5 6 7 8 9

Length (bits) 3 4 1 0 or 5 1 0 or 5 15 15 3 5 TAG_LEN 8 1, 4 or 7

SPEC_TAG_TYPE ROAM_DISP_IND

Specific tag record type. This field is set to 000 (see Table 3.5.10.2-1). Roaming display indicator. The mobile station shall set this field to the value of the action for displaying the default roaming indicator on the mobile stations display. The values are: ROAM_DISP_IND 0000 0001 0010 0011 1111 Action Default Roaming Indicator off. Default Roaming indicator on. Default Roaming Indicator flashing. Reserved

10 11 12 13 14 15 16 17 18

ENCODING_INCL

Tag encoding indicator flag. The mobile station shall set this field to 1 if the TAG_ENCODING field is included. Otherwise, the mobile station shall set this field to 0.

TAG_ENCODING

Tag encoding format. See [4]. This field shall be set to indicate the character set used in the TAG field included in this parameter block.

CALL_PRMPT_INCL

Call Prompt Included Flag

3-227

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to 1 if the CALL_PRMPT field is included in this parameter block. Otherwise, the mobile station shall set this field to 0 CALL_PRMPT Call prompt identifier If a Call Prompt is associated with the Home System Tag, the mobile station shall set this field to the associated Call Prompt Identifier (see 3.5.10.4). Otherwise, this field shall be omitted. LOW_SID Lowest applicable System Identification The mobile station shall set this field to the System Identification (SID) having the lowest value over the range of SID values for which this Specific Tag Record is associated. (See [7]). HIGH_SID Highest applicable System Identification The mobile station shall set this field to the System Identification (SID) having the highest value over the range of SID values for which this Specific Tag Record is associated. (See [7]). SID_INC System identifier increment The mobile station shall set this field to the increment to be used to construct SIDs of the systems associated with this record. SIDs of the systems associated with this record are multiples of this value between LOW_SID and HIGH_SID inclusive. This field shall be set to a value in the range 1 to 7 inclusive. TAG_LEN Tag length The mobile station shall set this field to the number of octets in the TAG field. TAG Specific Tag. The mobile station shall set this field to characters based on the encoding method defined in TAG_ENCODING. RESERVED Reserved bits. The mobile station shall set this field to 0 if ENCODING_INCL = 0 and CALL_PRMPT_INCL = 0. The mobile station shall set this field to 0000 if either ENCODING_INCL = 1 or CALL_PRMPT_INCL = 1. The mobile station shall set this field to 0000000 if ENCODING_INCL = 1 and CALL_PRMPT_INCL = 1.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39

40 41 42

3.5.11.4

Call Prompt Record Format

Each Call Prompt Record has the following format:

3-228

3GPP2 C.S0016-D v2.0

Call Prompt Record Field CALL_PRMPT CALL_PRMPT_TEXT_STATE ENCODING_INCL PRMPT_ENCODING PRMPT_LEN PRMPT RESERVED
1 2 3 4 5 6 7 8 9

Length (bits) 5 2 1 0 or 5 5 PRMPT_LEN 8 3 or 6

CALL_PRMPT

Call prompt identifier. The mobile station shall set this field to the call prompt identifier for the given record entry.

CALL_PRMPT_TEXT_STATE

Call Prompt Text State

The mobile station shall set this field to the text state for the text to be displayed by the mobile station according to the following table: CALL_PROMPT_TEXT_STATE 00 01 10 11 Action Call Prompt text on. Call Prompt text flashing. Reserved

10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

ENCODING_INCL

Call prompt character encoding included flag. The mobile station shall set this field to 1 if the PRMPT_ENCODING field is included. Otherwise, the mobile station shall set this field to 0.

PRMPT_ENCODING

Character Encoding. See [4]. This field shall be set to indicate the character set used in the PRMPT field included in this parameter block.

PRMPT_LEN

Call prompt length indicator The mobile station shall set this field to indicate the number of octets of the PRMPT field.

PRMPT

Call prompt. The mobile station shall set this field to the characters based on the encoding method defined in PRMPT_ENCODING.

RESERVED

Reserved bits.

3-229

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to 000 if ENCODING_INCL = 0. Otherwise, the mobile station shall set this field to 000000. 3.5.12 MMS Parameter Block Table 3.5.12-1 lists the types of parameter blocks used in the MMS Configuration Request Message and the MMS Configuration Response Message.

1 2 3

4 5 6 7 8

Table 3.5.12-1 MMS Parameter Block Types Parameter Block Type MMS URI Parameters MMS URI Capability Parameters Reserved BLOCK_ID 00000000 00000001 00000010 through 11111111 Reference 3.5.12.1 3.5.12.2

9 10 11

3.5.12.1 MMS URI Parameters The PARAM_DATA field of the MMS URI Parameters Block consists of the following fields: Field NUM_MMS_URI 4 Length (bits)

NUM_MMS_URI occurrences of the following fields: MMS_URI_ENTRY_IDX 4 MMS_URI_LENGTH MMS URI 8 8 x MMS_URI_LENGTH

RESERVED
12 13 14 15 16 17 18 19 20 21 22

0 to 7

NUM_MMS_URI

Number of MMS URIs The mobile station shall set this field to the number of MMS URIs stored on the mobile, encoded in ASCII string, refer to [16], [17] and [18].

The mobile station shall include NUM_MMS_URI occurrences of the following fields: MMS_URI_ENTRY_IDX MMS URI entry index. The mobile station shall set this field to the index in the MMS URI Table, refer to [16], [17] and [18]. MMS_URI_LENGTH MMS URI length. The mobile station shall set this field to the length of the URI associated with the MMS Relay/Server in units of octet

3-230

3GPP2 C.S0016-D v2.0 MMS_URI MMS_URI The mobile station shall set this field to the URI of the MMS Relay/Server, encoded in ASCII string, refer to [16], [17] and [18]. RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'. 3.5.12.2 MMS URI Capability Parameters The PARAM_DATA field of the MMS URI Capability Parameters Block consists of the following fields:

1 2 3 4 5 6 7 8

9 10 11 12

Field MAX_NUM_MMS_URI MAX_MMS_URI_LENGTH RESERVED

13 14 15 16 17 18 19 20 21 22 23 24

Length (bits) 4 8 7

MAX_NUM_MMS_URI

Maximum MMS URI Entries. The mobile station shall set this field to the maximum number of MMS URI entries supported by the mobile station.

MAX_MMS_URI_LENGTH -

Maximum MMS URI length. The mobile station shall set this field to the maximum length, in units of octets, of the MMS URI supported by the mobile station.

RESERVED

Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets.

3-231

3GPP2 C.S0016-D v2.0 3.5.13 MMSS Configuration Parameter Blocks Table 3.5.13-1 lists the types of parameter blocks used in the MMSS Configuration Request Message and the MMSS Configuration Response Message. Table 3.5.13-1 MMSS Configuration Parameter Block Types Parameter Block Type AIR_INT_TYPE Supported MMSS MODE SETTINGS BLOCK_ID 00000000 00000001 Reference 3.5.13.1 3.5.13.2 3.5.13.3 3.5.13.4 3.5.13.5

1 2 3 4 5

MMSS Location Associated Priority List 00000010 (MLPL) MMSS System Priority List (MSPL) MMSS WLAN Configuration Parameter Reserved for future access technologies 00000011 00000100 00000101 through 01111111

Available for manufacturer-specific 10000000 parameter block definitions through 11111110 Reserved
6

See [4]

11111111

7 8 9

3.5.13.1 AIR_INT_TYPE SUPPORTED Parameter Block PARAM_DATA consists of the following: Type-specific Record WiMAX SUPPORTED WLAN SUPPORTED GSM_SUPPORTED UMTS_SUPPORTED LTE_SUPPORTED 1x_SUPPORTED HRPD_SUPPORTED 1 1 1 1 1 1 1 Length (bits)

Reserved for future types of access 57 technologies

10

3-232

3GPP2 C.S0016-D v2.0 WiMAX_SUPPORTED The mobile shall set this field to 1 to indicate that the mobile station is capable of supporting WiMAX; otherwise this field shall be set to 0. The mobile shall set this field to 1 to indicate that the mobile station is capable of supporting WLAN; otherwise this field shall be set to 0. The mobile shall set this field to 1 to indicate that the mobile station is capable of supporting GSM; otherwise this field shall be set to 0. The mobile shall set this field to 1 to indicate that the mobile station is capable of supporting UMTS; otherwise this field shall be set to 0. The mobile shall set this field to 1 to indicate that the mobile station is capable of supporting LTE; otherwise this field shall be set to 0. The mobile shall set this field to 1 to indicate that the mobile station is capable of supporting 1x; otherwise this field shall be set to 0. The mobile shall set this field to 1 to indicate that the mobile station is capable of supporting HRPD; otherwise this field shall be set to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

WLAN SUPPORTED

GSM_SUPPORTED

UMTS_SUPPORTED

LTE_SUPPORTED

1x_SUPPORTED

HRPD_SUPPORTED

22

23 24 25 26 27

3.5.13.2 MMSS MODE SETTINGS Parameter Block The MMSS Mode Settings is applicable to cdma2000 and non-cdma2000 cellular systems. The MMSS Mode Settings is associated with MMSS System Priority List. The PARAM_DATA field of the MMSS Mode Settings consists of the following fields: Field MMSS_MODE Length (bits) 8

28 29 30 31 32 33 34 35 36 37 38 39

MMSS_MODE

MMSS Mode. The mobile station shall set this field to the current MMSS mode of the mobile station where: Manual mode systems are selected manually by the user. Power-up Auto mode - the mobile station automatically acquires the appropriate system during power-up. After power-up, selections are preformed manually. Automatic mode automatically. the appropriate system is selected

The values for each mode are given in the following table.

3-233

3GPP2 C.S0016-D v2.0

Bit Bit 0 Bit 1 Bit 2 Bits 3 7

1 2 3 4

MMSS Allowed Modes Manual Allowed XXXXXXX1 Manual not Allowed XXXXXXX0 Power-up Auto Mode Allowed XXXXXX1X Power-up Auto Mode not Allowed XXXXXX0X Automatic Allowed XXXXX1XX Automatic not Allowed XXXXX0XX RESERVED

RESERVED

Reserved bits. The mobile station shall set this field to 00000.

5 6 7 8 9 10 11

3.5.13.3 MMSS Location Associated Priority List (MLPL) Parameter Block The MLPL is a list of groupings based on location specific information. MLPL allows the base station to specify the MMSS System Priority List to be used in a location grouping. Different types of location groupings are specified in Table 3.5.13.3-1. Each entry in the MLPL points to an MSPL (see section 3.5.13.4). The MLP_LISTS-P, which stores the MLPL, consists of the following fields:

Field MLPL_SIZE CUR_MMSS_P_REV MLPL_VER_ID MLPL_ID NUM_MLPL_RECS

12

Length (bits) 16 8 16 8 8

NUM_MLPL_RECS occurrences of the following three fields: LOC_PARAM_TYPE LOC_PARAM_VAL MSPL_INDEX 8 Variable 8

RESERVED MLPL_CRC
13

0 to 7 16

3-234

3GPP2 C.S0016-D v2.0 MLPL_SIZE MMSS Location associated priority list size. This field is set to the total size, in octets, of the MLPL, including the MLPL_SIZE and MLPL_CRC fields. CUR_MMSS_P_REV Protocol Revision MMSS_P_REV of the mobile stations current

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

The mobile station shall set this field to the value of the MMSS_P_REV associated with this MLPL. MLPL_VER_ID MLPL Version Identification The mobile station shall set this field to the value of the MLPL Version Identification assigned for the MLPL (MLP_LISTs-p) by the base station. MLPL_ID MMSS Location Priority List identification. Unique identification for the MLPL assigned by the base station. NUM_MLPL_RECS LOC_PARAM_TYPE Number of MMSS Location Associated priority records. This field is set to the number of entries in the MLPL. Location Parameter Type This field identifies the parameter used for Location grouping. Possible parameters are described in Table 3.5.13.3-1. The location parameter type can be specified as any combinations of MCC, MNC and NUM_SYS_LOC_TAG. The NUM_SYS_LOC_TAG bit specifies the location grouping to which this MLPL record belongs. When bits 0, 1, and 2 are all set to 0 the Default type shall be used. The Default type represents the case when no location information is available to the device.

3-235

3GPP2 C.S0016-D v2.0 Table 3.5.13.3-1 LOC_PARAM_TYPE Bit Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 LOC_PARAM_TYPE Description Reserved Reserved Reserved Reserved Reserved NUM_SYS_LOC_TAG specified XXXXX1XX NUM_SYS_LOC_TAG not specified XXXXX0XX Bit 1 Bit 0 MNC specified XXXXXX1X MNC not specified XXXXXX0X MCC specified XXXXXXX1 MCC not specified XXXXXXX0
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

Reserved LOC_PARAM_VAL

Reserved bit. The mobile station shall set each reserved bit to 0. Location Parameter Value LOC_PARAM_VAL is the value of the Location Parameter used. The length of this field is variable in length and depends on the LOC_PARAM_TYPE used for location grouping. If bit 0 of LOC_PARAM_TYPE is set to 1, LOC_PARAM_VAL begins with an MCC field. If bit 1 of LOC_PARAM_TYPE is set to 1, LOC_PARAM_VAL contains a MNC field. If bit 2 of LOC_PARAM_TYPE is set to 1, LOC_PARAM_VAL will contain a field called NUM_SYS_LOC_TAG. This field specifies the number of additional records that are present in LOC_PARAM_VAL. The fields in LOC_PARAM_VAL for each LOC_PARAM_TYPE is described in Table 3.5.13.3-2.

3-236

3GPP2 C.S0016-D v2.0 Table 3.5.13.3-2 LOC_PARAM_VAL LOC_PARAM_VAL MCC MNC NUM_SYS_LOC_TAG
2 3

Length in bits 0 or 12 0 or 12 0 or 8

If LOC_PARAM_TYPE has the value XXXXX1XX, the LOC_PARAM_VAL has NUM_SYS_LOC_TAG occurrences of the following fields: SYS_TYPE SYS_LOC_TAG_SIZE SYS_LOC_TAG RESERVED 8 8 Variable 0 to 7

4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

MCC

Mobile Country Code. If Bit 0 of LOC_PARAM_TYPE is set to 1, this field shall be included and shall be set to the Mobile Country Code using BCD encoding; otherwise this field shall be omitted.

MNC

Mobile Network Code. If Bit 1 of LOC_PARAM_TYPE is set to 1, this field shall be included and shall be set to the Mobile Network Code using BCD encoding. If the length of the MNC is two digits, the least significant digit is encoded with 0xFF. For example, MNC=23 is set to 0x23F23F [31]. Otherwise this field shall be omitted.

NUM_SYS_LOC_TAG

Number of System Location Tags If Bit 2 of LOC_PARAM_TYPE is set to 1, this field shall be set to the number of system location information applicable to this LOC_PARAM_VAL; otherwise this field shall be omitted.

SYS_TYPE

System Type. This field shall be set to the system type specified in Table 3.5.13.4-1.

SYS_LOC_TAG_SIZE SYS_LOC_TAG

System Location Tag Size Size of SYS_LOC_TAG in bits. System Location Tag. This field shall be set according to the system record associated with the system type specified in SYS_TYPE If SYS_TYPE is set to 00000000 (cdma2000_AI) or 00000011 (cdma2000 1x) the SYS_LOC_TAG shall consist of the following fields:

3-237

3GPP2 C.S0016-D v2.0

System Location Tag RESERVED SID NID_START NID_RANGE

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Length in bits 1 15 16 8

RESERVED SID NID_START

Reserved bit. The mobile station shall set this field to 0. System ID. A number uniquely identifying a cdma2000 system. Network ID Start NID_START specifies the first NID value from the cdma2000 PRL to be included in the System Location Tag. If NID_START is set to 1111111111111111 (NID wildcard), any system with a SID equal to the value in the SID field is a match to the SYS_LOC_TAG.

NID_RANGE

Network ID Range. NID_RANGE specifies the number of consecutive NIDs following NID_START within the cdma2000 PRL. Therefore, the last NID value specified by NID_RANGE shall be equal to NID_START + NID_RANGE. If only one NID value is specified (i.e., NID_START), the NID_RANGE shall be set to 00000000. If SYS_TYPE is set to 00000001 (3GPP_AI), 00000101 (GERAN (GSM)), 00000110 (UTRAN (UMTS)), or 00000111 (EUTRAN (LTE)), the SYS_LOC_TAG shall consist of the following fields: System Location Tag PLMN_START PLMN_RANGE Length in bits 24 8

24 25 26 27 28 29 30 31 32

PLMN_START

PLMN Start PLMN_START specifies the first PLMN [26] value from the PLMN Selector List to be included in the System Location Tag.

PLMN_RANGE

PLMN Range. PLMN_RANGE specifies the number of consecutive PLMNs following PLMN_START within the PLMN Selector List. If only one PLMN value is specified (i.e., PLMN_START), the PLMN_RANGEOFFSET shall be set to 00000000.

3-238

3GPP2 C.S0016-D v2.0 If SYS_TYPE is set to 00000100 (cdma2000 HRPD), the SYS_LOC_TAG shall consist of the following three fields: System Location Tag SUBNET_COMMON_LENGTH SUBNET_IDCOMMON RESERVED
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36

1 2

Length in bits 8 SUBNET_COMMON_LENGT H 0 to 7

SUBNET_LENGTH

Subnet ID Length. This field specifies the length of the Subnet ID. The maximum Subnet_LENGTH is 128. The values '10000001' (129) to 11111111 (255) shall be reserved. Note: when the SUBNET_LENGTH is 128, the SUBNET_ID is equivalent to the SECTOR_ID.

SUBNET_ID RESERVED

Subnet ID. This field is set to the SUBNET_ID. Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of this SYS_LOC_TAG equal to an integer number of octets. Each reserved bit shall be set to '0.

SUBNET_COMMON_LENGTH

- Length of the common part of the HRPD subnet.

This field is set to the length of the most significant bits of the HRPD subnet which is included in this record. The maximum SUBNET_COMMON_LENGTH is 128. The values '10000001' (129) to 11111111 (255) shall be reserved. Note: when the SUBNET_COMMON_LENGTH is 128, the SUBNET_ID is equivalent to the SECTOR_ID. SUBNET_COMMON RESERVED Common part of the HRPD subnet. This field is set to the HRPD subnet. Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0 MSPL_INDEX MMSS System Priority List Index This field is set to the MSPL_ID of the MMSS System Priority List corresponding to an MLPL entry. RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0. MLPL_CRC CRC for MLPL

3-239

3GPP2 C.S0016-D v2.0 This field is set to the 16-bit CRC calculated according to 3.5.14.1.

1 2 3 4

5 6 7 8 9 10 11 12 13 14

3.5.13.4 MMSS System Priority List (MSPL) The MSPL is a prioritized list of cdma2000 and non-cdma2000 cellular systems. The MSPL assists a multimode mobile station in selecting a system. Once a system is selected, the mobile station follows the standard network selection procedures for the selected system to acquire a network. There can be one or more MSPLs in the MS. The MSPL can be sent to the mobile station over-the-Air. The MSPL is retained by the mobile station when power is turned off. There shall be only one MSPL associated with a location grouping in the MLPL. The MSP_LISTS-P, which stores the MSPL, consists of the following fields:

Field MSPL_SIZE CUR_MMSS_P_REV MSPL_VER_ID NUM_MSPL_ID

Length (bits) 16 8 16 8

NUM_MSPL_ID occurrences of the following fields: { (NUM_MSPL_ID} MSPL_ID NUM_MSPL_RECS

15 16

8 8

NUM_MSPL_RECS occurrences of the following six fields: { (NUM_MSPL_RECS} SYS_TYPE PRI_CLASS SYS_PRI HIGHER_PRI_SRCH_TIME NETWORK_CAP_IND NETWORK_CAP } (NUM_MSPL_RECS) } (NUM_MSPL_ID} RESERVED 0 to 7 8 4 1 3 1 6 or 0

3-240

3GPP2 C.S0016-D v2.0

MSPL_CRC
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

16

MSPL_SIZE

MMSS system priority list size. This field is set to the total size, in octets, of the MMSS System Priority List, including the MSPL_SIZE and MSPL_CRC fields.

CUR_MMSS_P_REV

Protocol Revision MMSS_P_REV

of

the

mobile

stations

current

The mobile station shall set this field to the value of the MMSS_P_REV associated with this MSPL. MSPL_VER_ID MSPL Version Identification The mobile station shall set this field to the value of the MSPL Version Identification assigned for the MSPL (MSP_LISTs-p) by the base station. NUM_MSPL_ID Number of MSPL IDs This field is set to the number of MSPL_IDs in this set of MSPL_IDs. MSPL_ID MMSS system priority list identification. MSPL_ID is the unique identifier of an MSPL table assigned by the base station. NUM_MSPL_RECS Number of MMSS system priority records. This field is set to the number of MMSS system priority records contained in the MSPL block. SYS_TYPE System Type identification. The system type shall be set according to Table 3.5.13.4-1.

3-241

3GPP2 C.S0016-D v2.0 Table 3.5.13.4-1 System Type System Type cdma2000_AI 3GPP_AI WiMAX cdma2000 1x cdma2000 HRPD GERAN (GSM) UTRAN (UMTS) EUTRAN (LTE) Reserved for future standardization
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

Value 00000000 00000001 00000010 00000011 00000100 00000101 00000110 00000111 00001000 11111111

PRI_CLASS

Priority Class. Priority Class defines the selection priority to be used in a system as allowed in that system. PRI_CLASS shall be one of the following. 0000- Home only. The mobile station can only use the home network in the system for system selection. This priority class includes networks defined to be equivalent to the home network. In some cases more than one network may be defined in the home priority class; for example, networks having equal priority in the network priority list for the system. 0001- Home + Preferred. This priority class includes both home and preferred networks. The mobile station can use home priority networks and preferred networks in the system for system selection. A preferred network of a system is defined as a network with the second highest priority in the priority list. 0010 to 1110 Reserved. 1111- Any. This priority class includes home, preferred and any networks for the system, including ones that are not listed or considered a preferred network in the priority list of a system. The mobile station can use any network in the system for system selection.

SYS_PRI

System Priority.

3-242

3GPP2 C.S0016-D v2.0 This field indicates the relative priority of systems in the MMSS system priority table. The relative priority can be more (1) or same (0). The last entry in the system priority table has the system priority set to 0. For each entry a 1 indicates that the current system type is of higher priority than the next system type in the table. For each entry a 0 indicates that the current system type is of same priority as the next system type in the table. HIGHER_PRI_SRCH_TIME - Higher Priority Search Time. Set to the time between searches of higher priority systems of other radio access technologies that the mobile station may use when this entry is the current system. This field shall be set to the value from Table 3.5.13.4-2 corresponding to the desired search time. Table 3.5.13.4-2 Higher Priority Search Time HIGHER_PRI_SRCH_TIME 000 001 010 011 100 101 110 111
16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Description 1 minute 2 minutes 4 minutes 8 minutes 16 minutes 24 minutes 32 minutes 64 minutes

NETWORK_CAP_IND

Network Capability Indicator. If a NETWORK_CAP is to be included in this MSPL record this field shall be set to 1. Otherwise this field shall be set to 0.

NETWORK_CAP

Network Capability. If the NETWORK_CAP_IND is set to 1, this field shall be set to a value from Table 3.5.13.4-3. Otherwise, it is omitted. This field is used to indicate the general capability of a system included in an MSPL record. For example, the presence of a Voice and Data NETWORK_CAP can be used to differentiate a GSM and GPRS voice and data system from a GSM voice only system in an MSPL record to assist system selection by the mobile station. In this case, a record with SYS_TYPE of '00000101' including a Voice and Data NETWORK_CAP is used to indicate both voice and data, and a record with SYS_TYPE of '00000101' without NETWORK_CAP is used to indicate Voice only. An MSPL that does not include NETWORK_CAP does not differentiate between Voice and Data and Voice only capability of SYS_TYPE '00000101'.

3-243

3GPP2 C.S0016-D v2.0

1 2

Table 3.5.13.4-3 Network Capability NETWORK_CAP Voice and Data Reserved 000000 000001 111111 Value

3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

RESERVED

Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'.

MSPL_CRC

CRC for MSPL This field is set to the 16-bit CRC calculated according to 3.5.14.1.

3.5.14 MMSS Location Associated Priority List and MMSS System Priority List

3.5.14.1 MLPL and MSPL CRC Calculation The 16-bit CRC field MLPL_CRC (or MSPL_CRC) is calculated on all bits of MMSS Location Associated Priority List (or MMSS System Priority List) excluding the bits of the MLPL_CRC (or MSPL_CRC) field itself. The generator polynomial for this CRC is 16 12 5 0 g(x) = x +x +x +x . The 16-bit CRC is calculated according to the following procedure using the logic shown in Figure 2.2.1-2: Initially, all shift register elements are set to logical one and the switches are set in the position A. The register is clocked with each MMSS Location Associated Priority List bit (or MMSS System Priority List bit) as an input, from the most significant bit of the MLPL_SIZE field (or MSPL_SIZE) through the least significant bit of the RESERVED field. The switches are set in the position B, and the register is clocked an additional 16 times. The 16 additional output bits constitute the CRC.

3-244

3GPP2 C.S0016-D v2.0 3.5.13.5 MMSS WLAN Configuration Parameters Type-specific Record WLAN_AIR_INT_ALLOWED NUM_WLAN_SERV_CAT 1 7 Length (bits)

1 2

NUM_WLAN_SERV_CAT occurrences of the following fields: WLAN_SERV_CAT_TYPE AUTO_ACQ_ALLOWED MANUAL_ACQ_ALLOWED SIMULTANEOUS_ALLOWED WLAN_SCAN_MODE WLAN_SCAN_LIMIT EMG_CALL_ALLOWED VOIP_SERVICES_ALLOWED POS_DET_ALLOWED NUM_WLAN_AIR_INT
3 4

8 1 1 1 1 3 1 1 1 8

NUM_WLAN_AIR_INT occurrences of the following field: WLAN_AIR_INT_TYPE 8

RESERVED
6 7 8 9 10 11 12 13 14 15 16 17 18

0 to 7

WLAN_AIR_INT_ALLOWED - The network shall set this field to 1 if WLAN is allowed. Otherwise, this field shall be set to 0. NUM_WLAN_SERV_CAT If WLAN_AIR_INT_ALLOWED is set to 1, set NUM_WLAN_SERV_CAT to the number of WLAN service categories supported. Otherwise this field shall be set to 0. This field is set according to Table 4.5.11.4-1 for the type of service category for this record. This field shall be set to 1 if WLAN can be acquired automatically. Otherwise this field shall be set to 0.

WLAN_SERV_CAT_TYPE AUTO_ACQ_ALLOWED -

MANUAL_ACQ_ALLOWED - This field shall be set to 1 if the mobile station is allowed to enable WLAN manually. Otherwise this field shall be set to 0.

3-245

3GPP2 C.S0016-D v2.0 SIMULTANEOUS_ALLOWED - This field shall be set to 1 if the mobile station is allowed to operate both WLAN radio when accessing or connected to WLAN_SERV_CAT_TYPE of User Defined and cellular systems at the same time. Otherwise this field shall be set to 0. WLAN_SCAN_MODE WLAN_SCAN_LIMIT If active scan is allowed, set this field to 1. Otherwise, set this field to 0. WLAN scanning duration is set by defining scan values given in Table 4.5.11.4-1. The WLAN_SCAN_LIMIT is used by a timer to allow the carrier to specify the maximum duration in minutes that the mobile station is permitted to search for WLAN based on time while the mobile station is in the idle mode. If the mobile station has not acquired and selected a WLAN system prior to the expiration of the timer, the mobile station shall stop performing time-based searches for WLAN systems. If another parameter causes the mobile station to search for WLAN prior to the expiration of the timer, the timer shall not be reset. If the duration of this parameter is reached, the timer shall be reset when another parameter causes the mobile station to search for WLAN. The specified parameter does not require a continuous search for WLAN. This is a time-based parameter for WLAN searches. Other parameters (e.g. manual override, launch of an application, change in location) that are not time-based can override this time-based parameter. If emergency call is allowed, set this field to 1. Otherwise, set this field to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38

EMG_CALL_ALLOWED

VOIP_SERVICES_ALLOWED - If VoIP services is allowed, set this field to 1. Otherwise, set this field to 0. POS_DET_ALLOWED NUM_WLAN_AIR_INT If position determination is allowed, set this field to 1. Otherwise, set this field to 0. This field shall be set to the number of WLAN air interfaces supported for this record. Otherwise this field shall be set to 0. WLAN_Air Interface Types. The mobile station shall set this field according to Table 3.5.13.5-1 to indicate the supported types of WLAN Air Interface Radio. Table 3.5.13.5-1 WLAN Air Interface Types AIR_INT_TYPE 00000000 00000001 00000010-11111111 Description Any IEEE 802.11 Air Interface Any WLAN Air Interface Reserved

WLAN_AIR_INT_TYPE

39

3-246

3GPP2 C.S0016-D v2.0 RESERVED Reserved bits. The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

1 2 3 4 5 6

3-247

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10

This page left intentionally blank.

3-248

3GPP2 C.S0016-D v2.0

BASE STATION PROCEDURES

4.1 Reserved 4.2 Initiation of the Programming Procedures 4.2.1 User-Initiated Procedure If the base station sends a message to the mobile station on the CDMA Paging Channel or Forward Common Control Channel, and if the active NAM of this mobile station has not been provisioned, the base station should address the message using the ESN or MEID of the mobile station. After receiving an activation origination, the base station should assign the mobile station to a CDMA Traffic Channel or analog voice channel and perform appropriate procedures as specified in 6.6.4 of [1] or 2.6.4 of [1]. The base station should not process an activation origination as an implicit registration (see 6.6.5.1 of [1] or 2.6.5.1 of [1]). The base station should not send the Mobile Station Registered Message (see 7.7.3.3.2.15 of [1] or 3.7.3.3.2.15 of [1]) during the programming session. If the mobile station includes authentication information when sending an activation origination, the base station should process the authentication data as required in 7.3.1 of [1] or 3.3.1 of [1]. During the programming session, the base station should invoke signaling message encryption and voice privacy (CDMA only) whenever available. If the base station sets the AUTH field of the Access Parameters Message to 01 or sets SENDING RAND field of the MC-RR Parameters Message to 1, and if the mobile station does not include authentication information when sending an activation origination, the base station shall not activate voice privacy or message encryption. If the base station sets the AUTH field of the Access Parameters Message to 01 or sets SENDING RAND field of the MC-RR Parameters Message to 1, and if the mobile station includes authentication information when sending an activation origination, but authentication fails, the base station may perform the following to provide signaling message encryption and voice privacy prior to performing full mobile station activation: The base station should complete the exchange of the A-key information and, optionally, set a non-default mobile station identifier. The base station should store the information in its database so that authentication and key calculation can be performed. Following the exchange of A-key information, the base station should perform SSD update (see 3.3.2) procedures of 6.3.12.1.9 of [1] or 2.3.12.1.5 of [1]. The base station may confirm the SSD update by performing the Unique Challenge-Response Procedure defined in 6.3.12.1.5 of [1] or 2.3.12.1.4 of [1]. When the SSD update has been completed, the base station may send the ReAuthenticate Message (see 4.3.2).

4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38

4-1

3GPP2 C.S0016-D v2.0 The base station may activate message encryption (see 4.3.3) and voice privacy (see 4.3.4). 4.2.2 Network-Initiated Procedure. If the network initiates OTAPA for the mobile station that is already in a CDMA Conversation Substate or the analog Conversation Task (i.e. the base station is communicating with the mobile station on the CDMA Traffic Channel or on the Analog Voice Channel), the base station shall send the OTAPA Request Message with the START_STOP field set to 1 to the mobile station in order to start the OTAPA session in the mobile station. If the network initiates OTAPA for the mobile station that is in the CDMA Mobile Station Idle State, the base station shall do the following: The base station shall page the mobile station and establish a Traffic Channel using the procedures defined in 7.6 of [1] or 3.6 of [1]. The base station shall request Service Option 18 or 19, and perform service negotiation. If the base station establishes a service configuration, as specified in a Service Connect Message, that includes a service option connection using Service Option 18 or 19, then the service option connection shall become part of the current service configuration at the action time associated with the Service Connect Message. Service Option 18 or 19 is considered connected when the current service configuration includes a service option connection for it. When the Service Option 18 or 19 is connected, the Service Option shall discard all primary traffic data bits received from the multiplex sublayer, and the base station should transmit null traffic channel data. The base station shall send the OTAPA Request Message with the START_STOP field set to 1 to the mobile station in order to start the OTAPA session in the mobile station.

1 2

3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

27

4.3 Programming Data Download 4.3.1 OTA Data Message Processing While in the CDMA Conversation Substate or the analog Conversation Task, the base station may send the messages prescribed below. If the base station sends a message requiring a response, the base station should wait for receipt of the appropriate response before sending further Over-the-Air Service Provisioning messages. If the base station does not receive a response to the message, it may retransmit the message. If the base station receives any OTASP Data Message containing the RESULT_CODE = 00001010, Rejected - Mobile station locked, or 00001011, Rejected - Invalid SPC or 00001101, Rejected - Invalid SPASM, indicating that the mobile station parameters are locked (see 3.3.6 and 3.3.7), the base station may attempt to unlock the mobile station before continuing the programming procedure.

28 29 30 31 32 33 34 35 36 37 38

4-2

3GPP2 C.S0016-D v2.0 If the base station receives any message containing a RESULT_CODE indicating any other error condition, the base station may terminate the programming session, or select appropriate action to correct the error condition. 4.3.1.1 Configuration Request Message Processing 1. Configuration Request Message: The base station should wait for a Configuration Response Message. 4.3.1.2 Download Request Message Processing 2. Download Request Message: The base station should wait for a Download Response Message. 4.3.1.3 Commit Request Message Processing 3. Commit Request Message: The base station should wait for a Commit Response Message. Upon receipt of the Commit Response Message with the RESULT_CODE set to 00000000, Accepted - Operation successful, the base station should update its stored database to include the activation information. 4.3.1.4 Re-Authenticate Request Message Processing 4. Re-Authenticate Request Message: The base station should wait for a Re-Authenticate Response Message. 4.3.1.5 MS Key Request Message Processing 5. MS Key Request Message: The base station should wait for an MS Key Response Message. 4.3.1.6 Key Generation Request Message Processing 6. Key Generation Request Message: The base station should receive an MS Key Response Message with RESULT_CODE equal to 00000000, Accepted - Operation successful, prior to sending this message. The base station should wait for a Key Generation Response Message. 4.3.1.7 Protocol Capability Request Message Processing 7. Protocol Capability Request Message: The base station should wait for a Protocol Capability Response Message or an Extended Protocol Capability Response Message. The base station mayshall not send the Protocol Capability Request Message with additional fields to the mobile stations which do not support the additional any or all fields defined in Section 4.5.1.7 to any mobile station.12

1 2 3

4 5 6

7 8 9

10 11 12 13 14

15 16 17

18 19 20

21 22 23 24 25

26 27 28 29 30 31

12 A mobile station that does not support the additional fields ignores those fields and responds with

a Protocol Capability Response Message.The base station may use the first 8 bits of the received value in the ESN field to determine if the value in the ESN field is a true ESN/UIMID (with a prefix other than 0x80) or a pseudo-ESN/pseudo-UIMID (with a prefix of 0x80). The first 8 bits only indicates the

4-3

3GPP2 C.S0016-D v2.0 4.3.1.8 SSPR Configuration Request Message Processing 8. SSPR Configuration Request Message: The base station should wait for an SSPR Configuration Response Message. 4.3.1.9 SSPR Download Request Message Processing 9. SSPR Download Request Message: The base station should wait for an SSPR Download Response Message. 4.3.1.10 Validation Request Message Processing 10. Validation Request Message: The base station should wait for a Validation Response Message. The following procedures may be used: In order to unlock the mobile station, the base station may send the Verify SPC Parameter Block with the SPC field set to the value of the Service Programming Code assigned to the mobile station. If the base station elects to change the value of the SPC assigned to the mobile station, the base station may send the Change SPC Parameter Block with the SPC field set to the value of the new Service Programming Code assigned to the mobile station. If the base station elects to permanently unlock the mobile station, the base station shall set the SPC field to the default value (see Table 3.3.6-1). In order to unlock the active mobile station NAM secured by SPASM, the base station may send the Validate SPASM Parameter Block. If the programming session was initiated by the user as described in 3.2.1, the base station should not send this Parameter Block. If the base station received the RAND_OTAPA value from the mobile station in the OTAPA Response Message, the base station should set the AUTH_OTAPA_INCL field to 1 and the AUTH_OTAPA field to the value computed by the base station as specified in 3.3.7. If the base station did not receive the RAND_OTAPA value from the mobile station in the OTAPA Response Message, the base station may not send this Parameter Block. If the base station sends this Parameter Block, the base station should set the AUTH_OTAPA_INCL field to 0 and omit the AUTH_OTAPA field.

1 2 3

4 5 6

7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

MEID capability of the mobile station if it is known by the base station that the mobile station is nonRUIM capable.

4-4

3GPP2 C.S0016-D v2.0 The base station should set the NAM_LOCK field to 1 to activate SPASM protection of programmable parameters and indicators of the active NAM for subsequent OTAPA session, otherwise the base station should set this field to 0. SPASM protection specified by the value of the NAM_LOCK field will take effect for the subsequent OTAPA session if it is committed into the permanent mobile station memory during the current OTAPA session.

1 2 3 4 5 6

7 8 9 10 11 12 13 14 15

4.3.1.11 OTAPA Request Message Processing 11. OTAPA Request Message: The base station should wait for an OTAPA Response Message. The following procedures may be used: If the programming session was initiated by the user as described in 3.2.1, the base station should not send this message. In order to invoke the OTAPA session in the mobile station, the base station shall set the START_STOP field to 1 in the message. In order to terminate the OTAPA session in the mobile station, the base station shall set the START_STOP field to 0 in the message.

16 17 18

4.3.1.12 PUZL Configuration Request Message Processing 12. PUZL Configuration Request Message: The base station should wait for a PUZL Configuration Response Message. 4.3.1.13 PUZL Download Request Message Processing 13. PUZL Download Request Message PUZL Download Response Message. : The base station should wait for a

19 20 21

22 23 24

4.3.1.14 3GPD Configuration Request Message Processing 14. 3GPD Configuration Request Message: The base station should wait for a 3GPD Configuration Response Message. 4.3.1.15 3GPD Download Request Message Processing 15. 3GPD Download Request Message: The base station should wait for a 3GPD Download Response Message. 4.3.1.16 Secure Mode Request Message Processing 16. Secure Mode Request Message: The base station should wait for a Secure Mode Response Message. The following procedures may be used: The base station shall generate the Secure Mode Ciphering Key (SMCK) as specified in 4.3.5. If SMCK generation is unsuccessful, the base station shall not send the message.

25 26 27

28 29 30 31 32 33

4-5

3GPP2 C.S0016-D v2.0 In order to invoke the Secure Mode in the mobile station, the base station shall set the START_STOP field to 1 and the RAND_SM field to a randomly selected 64-bit value used for generating the Secure Mode Ciphering Key SMCK (see 4.3.5). Upon receipt of the Secure Mode Response Message with the RESULT_CODE set to 00000000, Accepted - Operation successful, the base station should activate the Secure Mode as specified in 4.3.5. In order to terminate the Secure Mode in the mobile station, the base station shall set the START_STOP field to 0 in the message.

1 2 3 4 5 6 7 8

9 10 11

4.3.1.17 MMD Configuration Request Message Processing 17. MMD Configuration Request Message: The base station should wait for a MMD Configuration Response Message. 4.3.1.18 MMD Download Request Message Processing 18. MMD Download Request Message: The base station should wait for a MMD Download Response Message. 4.3.1.19 System Tag Configuration Request Message Processing 19. System Tag Configuration Request Message: The base station should wait for a System Tag Configuration Response Message. 4.3.1.20 System Tag Download Request Message Processing 20. System Tag Download Request Message: The base station should wait for a System Tag Download Response Message. 4.3.1.21 Service Key Generation Request Message Processing 21. Service Key Generation Request Message: The base station should wait for a Service Key Generation Response Message. 4.3.1.22 MMS Configuration Request Message Processing 22. MMS Configuration Request Message: The base station should wait for a MMS Configuration Response Message. 4.3.1.23 MMS Download Request Message Processing 23. MMS Download Request Message: The base station should wait for a MMS Download Response Message. 4.3.1.24 MMSS Configuration Request Message Processing 24. MMSS Configuration Request Message: The base station should wait for an MMSS Configuration Response Message.

12 13 14

15 16 17

18 19 20

21 22 23

24 25 26

27 28 29

30 31 32

4-6

3GPP2 C.S0016-D v2.0 4.3.1.25 MMSS Download Request Message Processing 25. MMSS Download Request Message: The base station should wait for an MMSS Download Response Message.

1 2 3 4

5 6 7 8 9 10 11 12 13 14 15

4.3.2 SSD Update and re-authentication Re-authentication is the process by which the base station instructs the mobile station to perform authentication and generate the Private Long Code Mask and Message Encryption parameters while on the CDMA Traffic channel or analog voice channel. The authentication key, A-key, should be generated in the mobile station during the present programming session. The base station shall disable voice privacy and message encryption prior to performing reauthentication. The Shared Secret Data, SSD, shall be generated prior to performing re-authentication. The procedure for setting the interface values and for generating the authentication signature, voice privacy and message encryption parameters, is described in 3.3.2. 4.3.3 Activation of Message Encryption To enhance the security of the programming session and to protect sensitive subscriber information, the base station should enable message encryption (see 7.3.2 of [1] or 3.3.2 of [1]). If message encryption was enabled or transition to the Private Long Code Mask was made (see 7.3.3 of [1] or 3.3.3 of [1]) before the re-authentication operation, message encryption parameters active at that time shall remain unchanged for the duration of the call. Otherwise, message encryption parameters are re-calculated during the re-authentication operation. In this case, the data used to initialize the algorithm for calculating message encryption parameters is computed based on parameters in effect at the time the ReAuthenticate Request Message was sent. Messages shall not be encrypted following an unsuccessful re-authentication. 4.3.4 Activation of Voice Privacy Mode To enhance the security of the programming session and to protect sensitive subscriber information, the base station should enable voice privacy (see 7.3.3 of [1] or 3.3.3 of [1]). If a transition to the Private Long Code Mask was made or signaling message encryption was activated (see 2.3.12.2.1 and 6.3.12.2 of [1] or 2.3.12.2 of [1]) before the reauthentication operation, the Private Long Code Mask active at that time shall remain unchanged for the duration of the call. Otherwise, the Private Long Code Mask is recalculated during the re-authentication operation. In this case, the data used to initialize the algorithm for calculating the Private

16 17 18 19 20 21 22 23 24 25 26 27

28 29 30 31 32 33 34 35 36

4-7

3GPP2 C.S0016-D v2.0 Long Code Mask is computed based on parameters in effect at the time the Re-Authenticate Request Message was sent. Voice privacy shall not be enabled following an unsuccessful re-authentication. 4.3.5 Secure Mode To enhance security of the programming session and to protect sensitive subscriber information, a method is provided to encrypt PARAM_DATA fields of Parameter Blocks in OTASP messages irrespective of the air interface message encryption described in 4.3.3. This method allows setting up a secure tunnel between the network based Over-The-Air Service Provisioning entity and the mobile station. If the mobile station indicates its support for Secure Mode by setting appropriate featurerelated fields in the Protocol Capability Response Message, the base station may activate the Secure Mode by sending the Secure Mode Request Message to the mobile station with the START_STOP field set to 1. Prior to initiating the Secure Mode, the base station should generate the Secure Mode Ciphering Key SMCK as specified in 4.3.5.1. The base station should not initiate the Secure Mode if generation of the SMCK is unsuccessful. The base station shall use the SMCK as a key for encryption and decryption, as specified in 4.3.5.2, of all PARAM_DATA of all Parameter Blocks sent and received by the base station in the OTASP Data Messages while the Secure mode is active. When encrypting the message, the base station should select a value of FRESH associated with this message and unique for the duration of Secure Mode session. The value of FRESH can be selected at random, or can be set to a monotonically increasing counter. When decrypting the message, the base station should use the value of FRESH received in the message. The base station can terminate the Secure Mode by sending the Secure Mode Request Message to the mobile station with the START_STOP field set to 0. When Secure Mode session is terminated, the base station should reset the SMCK to NULLSMCK. 4.3.5.1 Generation of Secure Mode Ciphering Key The Secure Mode Ciphering Key Generation SMCK is generated by the algorithmic function specified in Section 2.2.2.6 of [8]. If KEY_IN_USE = 0000, the input parameters to the algorithmic function f3 shall be set as follows: The K parameter shall be set to SSD-A|SSD-B. The fi parameter shall be set to 0x45. The RAND parameter shall be set to RAND_SM|RAND_SM. The Fmk parameter shall be set to 0x41484147. If KEY_IN_USE = 0001,the input parameters to the algorithmic function f3 shall be set as follows:

1 2 3

4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

28 29 30 31 32 33 34 35 36 37 38

4-8

3GPP2 C.S0016-D v2.0 The K parameter shall be set to the 128-bit Root Key K. The fi parameter shall be set to 0x45. The RAND parameter shall be set to RAND_SM|RAND_SM. The Fmk parameter shall be set to 0x41484147. The base station shall execute the Ciphering Key Generation Procedure as specified in 2.2.2.6 of [8]. The base station shall set SMCK to the computed 128-bit output of f3. The base station shall set input parameter to the ESP_privacykey Procedure as follows: The key parameter shall be set to SMCK.

1 2 3 4 5 6 7 8 9

The base station shall execute the ESP_privacykey Procedure. 4.3.5.2 Encryption and Decryption of Messages in Secure Mode Encryption and decryption of PARAM_DATA information is performed by the Enhanced Privacy Algorithm specified in 2.3.2.2 of [8]. The base station shall set input parameters to the Enhanced Privacy Algorithm as follows: If the base station presents the data for encryption, the base station shall set the fresh parameter to FRESH| 1|BLOCK_ID; otherwise, if the base station presents the data for decryption, the base station shall set the fresh parameter to FRESHr| 0|BLOCK_ID; The freshsize parameter shall be set to 3; The buf parameter shall be set to the address of the octet containing the first bit of the buffer that contains the data to be encrypted or decrypted. The bit_offset parameter shall be set to the offset between the bit position of the most significant bit of the data to be encrypted/decrypted and the bit position of the most significant bit of the buffer (e.g., if the bit position of the most significant bit of the data to be encrypted/decrypted and the bit position of the most significant bit of the buffer are equal, bit_offset shall be set to 0). The bit_count parameter shall be set to the number of bits of the data to be encrypted/decrypted.

10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

The base station shall execute the ESP_maskbits Procedure. 4.3.6 Generation of Service Keys Generation of service keys consists of generating an intermediate key and using the intermediate key to generate service keys. 4.3.6.1 Generation of Intermediate Key The Intermediate value ITM_RAND is generated by the algorithmic function specified in Section 2.2.2.2 of [8]. The input parameters to the algorithmic function f0 shall be set as follows:

29 30 31

32 33 34 35

4-9

3GPP2 C.S0016-D v2.0

The K parameter shall be set to RKP. The fi parameter shall be set to 0x41. The Fmk parameter shall be set to 0x534B474B. The base station shall execute f0 twice. ITM_RAND is set to the 128-bit output of f0. 4.3.6.2 Generation of Service Keys For each bit in the bitmap as illustrated in Table 4.5.1.22-1 that is turned on, the base station shall generate the service key by invoking key generation function as specified in Section 2.2.2.6 of [8]. The input parameters to the algorithmic function f3 shall be set as follows: The K parameter shall be set to ITM_RAND. The fi parameter shall be set to 0x45. The RAND parameter shall be set according to table 4.3.6.2-1, with remaining least significant bits padded with 0, for each service requested. The Fmk parameter shall be set to 0x534B474B. The base station shall execute f3 to produce 128-bit service root key. Table 4.3.6.2-1 Key Identifier Table Service Key Requested IMS ROOT KEY BCMCS ROOT KEY WLAN ROOT KEY RAND Value 0x494D53 0x42434D4353 0x574C414E

2 3 4

5 6 7 8 9 10 11 12 13 14 15 16

17

18 19 20 21 22 23 24 25 26 27 28

4.4 Termination of the Programming Procedure The programming session ends when the OTAPA service option is disconnected. If the programming session was initiated by the network as described in 3.2.2, and if the base station processes the incoming call directed to the mobile station during the OTAPA process, the base station shall perform the following: 1. If either the mobile station or the base station does not support concurrent services the base station shall disconnect the OTAPA session and may release the traffic channel prior to connecting the incoming call. 2. If both the mobile station and base station supports concurrent service then the base station may disconnect the OTAPA session and may release the traffic channel prior to connecting the incoming call.

4-10

3GPP2 C.S0016-D v2.0 If the programming session was initiated by the network as described in 3.2.2, the base station may terminate the OTAPA session by sending the OTAPA Request Message to the mobile station with the START_STOP field set to 0. 4.5 Forward Link Message Formats The forward link OTASP Data Messages are summarized in Table4.5-1.

1 2 3

4 5 6

4-11

3GPP2 C.S0016-D v2.0 Table 4.5-1 Forward Link Messages Message Name Configuration Request Message Download Request Message MS Key Request Message Key Generation Request Message Re-Authenticate Request Message Commit Request Message Protocol Capability Request Message SSPR Configuration Request Message SSPR Download Request Message Validation Request Message OTAPA Request Message PUZL Configuration Request Message PUZL Download Request Message 3GPD Configuration Request Message 3GPD Downloaded Request Message Secure Mode Request Message Reserved MMD Configuration Request Message MMD Download Request Message System Tag Configuration Request Message System Tag Download Request Message OTASP_MSG_TYPE 00000000 00000001 00000010 00000011 00000100 00000101 00000110 00000111 00001000 00001001 00001010 00001011 00001100 '00001101' '00001110' 00001111 00010000 00010001 00010010 00010011 00010100 4.5.1.18 4.5.1.19 4.5.1.20 4.5.1.21 Reference 4.5.1.1 4.5.1.2 4.5.1.3 4.5.1.4 4.5.1.5 4.5.1.6 4.5.1.7 4.5.1.8 4.5.1.9 4.5.1.10 4.5.1.11 4.5.1.12 4.5.1.13 4.5.1.14 4.5.1.15 4.5.1.16

4-12

3GPP2 C.S0016-D v2.0

Message Name Service Key Generation Request Message MMS Configuration Request Message MMS Download Request Message MMSS Configuration Request Message MMSS Download Request Message Reserved for future standardization Reserved for manufacturerspecific OTASP Data Message definition Reserved for future standardization Available for manufacturerspecific OTASP Data Message definition Reserved
1 2

OTASP_MSG_TYPE 00010101 00010110 00010111 00011000 00011001 00011010 through 01111111 10000000

Reference 4.5.1.22 4.5.1.23 4.5.1.24 4.5.1.25 4.5.1.26

See [4]

10000001 through 10111111 11000000 through 11111110 11111111 See [4]

4.5.1 Message Contents 4.5.1.1 Configuration Request Message The Configuration Request Message has the following variable-length format: Field OTASP_MSG_TYPE (00000000) NUM_BLOCKS 8 8 Length (bits)

4 5

NUM_BLOCKS occurrences of the following field: BLOCK_ID

6 7 8

OTASP_MSG_TYPE

OTASP Data Message type. The base station shall set this field to 00000000.

4-13

3GPP2 C.S0016-D v2.0 NUM_BLOCKS Number of parameter blocks requested. The base station shall set this field to the number of parameter blocks requested. BLOCK_ID Parameter block identifier. The base station shall include NUM_BLOCKS occurrences of this field. The base station shall set each field to the value of the parameter block type requested (see Table 3.5.2-1). 4.5.1.2 Download Request Message The Download Request Message has the following variable-length format: Field OTASP_MSG_TYPE (00000001) NUM_BLOCKS 8 8 Length (bits)

1 2 3 4 5 6 7

8 9

NUM_BLOCKS occurrences of the following parameter block: BLOCK_ID BLOCK_LEN PARAM_DATA 8 8 8 BLOCK_LEN

FRESH_INCL FRESH RESERVED

10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

1 0 or 15 0 or 7

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The base station shall set this field to 00000001. Number of parameter blocks. The base station shall set this field to the number of parameter blocks contained in the Download Request Message.

BLOCK_ID

Parameter block identifier. The base station shall include NUM_BLOCKS occurrences of this field. The base station shall set each field to the value of the parameter block type requested (see Table 4.5.2-1).

BLOCK_LEN

Parameter block length. The base station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields.

PARAM_DATA

Parameter data fields.

4-14

3GPP2 C.S0016-D v2.0 The base station shall include the parameter block (see 4.5.2) specified by the BLOCK_ID field. If Secure Mode is active (see 4.3.5), PARAM_DATA fields shall be encrypted as specified in 4.3.5. FRESH_INCL FRESH included indicator. If Secure Mode is active (See 4.3.5), the base station shall include this field and set it to 1; otherwise the base station shall set this field to 0. FRESH Cryptographic Synchronizer (crypto-sync) selected encrypting PARAM_DATA fields of the message. for

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

If FRESH_INCL = 1, the base station shall include this field and set it to a 15-bit value chosen as specified in 4.3.5 for encrypting the PARAM_DATA fields of all Parameter Data blocks included in the message; otherwise the base station shall omit this field. RESERVED Reserved bits. If FRESH_INCL = 1, the base station shall omit this field; otherwise, the base station shall set all the bits of this field to 0. 4.5.1.3 MS Key Request Message The MS Key Request Message has the following variable-length format: Field OTASP_MSG_TYPE (00000010) A_KEY_P_REV PARAM_P_LEN PARAM_P PARAM_G_LEN PARAM_G 8 8 0 or 8 0 or 8 PARAM_P_LEN 0 or 8 0 or 8 PARAM_G_LEN Length (bits)

20 21

22 23 24 25 26 27 28 29 30 31 32 33

OTASP_MSG_TYPE A_KEY_P_REV

OTASP Data Message type. The base station shall set this field to 00000010. Key exchange protocol version. The base station shall set this field to 00000010 for 2G A-key generation, 00000011 for combination 2G A-key and 3G Root Key generation, 00000100 for 3G Root Key generation, or 00000101 for Enhanced 3G Root Key generation, 00000111 for eHRPD Root Key A_KEY_P_REV = 00000111 generation, or 00001000 for eHRPD Root Key A_KEY_P_REV = 00001000 generation.

PARAM_P_LEN

Length of PARAM_P field.

4-15

3GPP2 C.S0016-D v2.0 If A_KEY_P_REV = 00000010, the base station shall set this field to the number of octets in the PARAM_P field, and the base station shall set this field to 01000000. If A_KEY_P_REV > 00000010, the base station shall omit this field. PARAM_P Key exchange parameter P. If A_KEY_P_REV = 00000010, the base station shall set this field as described in 5.2.1. If A_KEY_P_REV > 00000010, the base station shall omit this field. PARAM_G_LEN Length of PARAM_G field. If A_KEY_P_REV = 00000010, the base station shall set this field to the number of octets in the PARAM_G field, and the base station shall set this field to 00010100. If A_KEY_P_REV > 00000010, the base station shall omit this field. PARAM_G Key exchange parameter G. If A_KEY_P_REV = 00000010, the base station shall set this field as described in 5.2.1. If A_KEY_P_REV > 00000010, the base station shall omit this field.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

21 22

4.5.1.4 Key Generation Request Message The Key Generation Request Message has the following variable-length format: Field OTASP_MSG_TYPE (00000011) BS_RESULT_LEN BS_RESULT 8 8 8 BS_RESULT_LEN Length (bits)

23 24 25 26 27 28 29

OTASP_MSG_TYPE BS_RESULT_LEN

OTASP Data Message type. The base station shall set this field to 00000011. Length of BS_RESULT field. The base station shall set this field to the number of octets in the BS_RESULT field.

BS_RESULT

Base station calculation result.

4-16

3GPP2 C.S0016-D v2.0 If A_KEY_P_REV = 00000010, the base station shall set this field equal to the value of BS_RESULT as described in 5.2.2. If A_KEY_P_REV = 00000011 or 00000100, the base station shall set this field equal to the value of BS_RESULT as described in 5.4.2. If A_KEY_P_REV = 00000101, the base station shall set this field equal to the value of BS_RESULT as described in 5.6.2. If A_KEY_P_REV = 00000111, the base station shall set this field equal to the value of BS_RESULT as described in 5.8.2. If A_KEY_P_REV = 00001000, the base station shall set this field equal to the value of BS_RESULT as described in 5.10.2.

1 2 3 4 5 6 7 8 9 10 11 12 13

14 15

4.5.1.5 Re-Authenticate Request Message The Re-Authenticate Request Message has the following fixed-length format: Field OTASP_MSG_TYPE (00000100) RAND 8 32 Length (bits)

16 17 18 19 20 21 22

OTASP_MSG_TYPE RAND

OTASP Data Message type. The base station shall set this field to 00000100. Random Challenge value. The base station shall set this field to the value used as an input to the Auth_Signature procedure for performing reauthentication. See 3.3.2.

23 24

4.5.1.6 Commit Request Message The Commit Request Message has the following fixed-length format: Field OTASP_MSG_TYPE (00000101) 8 Length (bits)

25 26 27 28

OTASP_MSG_TYPE

OTASP Data Message type. The base station shall set this field to 00000101.

4-17

3GPP2 C.S0016-D v2.0 4.5.1.7 Protocol Capability Request Message The Protocol Capability Request Message has the following variable-length format: Field OTASP_MSG_TYPE (00000110) OTASP_P_REV NUM_CAP_RECORD 8 0 or 8 0 or 8 Length (bits)

1 2

NUM_CAP_RECORDOne or more occurrences of the following record: CAP_RECORD_TYPE

3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

0 or 8

OTASP_MSG_TYPE OTASP_P_REV

OTASP Data Message type. The base station shall set this field to 00000110. OTASP protocol revision. If the base station does not request new capability information records as defined in Table 3.5.1.17.1-1, the base station shall omit this field; otherwise, the base station shall set this field to 00000100.

NUM_CAP_RECORDS -

Number of Capability Records. If OTASP_P_REV field is not included, the base station shall omit this field; otherwise, the base station shall set this field to the number of Capability Records requested.

CAP_RECORD_TYPE -

Capability Record Type. If OTASP_P_REV field is not included, the base station shall omit this field; otherwise, the base station shall set this field to the record type value shown in Table 3.5.1.17.1-1 corresponding to the information record requested.

4-18

3GPP2 C.S0016-D v2.0 4.5.1.8 SSPR Configuration Request Message The SSPR Configuration Request Message has the following variable-length format: Field OTASP_MSG_TYPE (00000111) BLOCK_ID 8 8 Length (bits)

1 2 3

If BLOCK_ID = 00000001 (Preferred Roaming List Parameter Block), the message also includes the following fields: REQUEST_OFFSET REQUEST_MAX_SIZE
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

16 8

OTASP_MSG_TYPE BLOCK_ID

OTASP Data Message type. The base station shall set this field to 00000111. Parameter block identifier. The base station shall set this field to the value of the BLOCK_ID of the parameter block being requested in this message (see Table 3.5.3-1).

If the BLOCK_ID field is set to 00000001 (Preferred Roaming List Parameter Block), the base station shall include the following fields in the message: REQUEST_OFFSET Segment offset. The base station shall set this field to the starting offset within the preferred roaming list (PR_LISTs-p) of the octets being requested. REQUEST_MAX_SIZE Maximum segment size. The base station shall set this field to the maximum number of preferred roaming list octets that the mobile station is to return.

4-19

3GPP2 C.S0016-D v2.0 4.5.1.9 SSPR Download Request Message The SSPR Download Request Message has the following variable-length format: Field OTASP_MSG_TYPE (00001000) BLOCK_ID BLOCK_LEN PARAM_DATA FRESH_INCL FRESH RESERVED
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

1 2 3

Length (bits) 8 8 8 8 BLOCK_LEN 1 0 or 15 0 or 7

OTASP_MSG_TYPE BLOCK_ID

OTASP Data Message type. The base station shall set this field to 00001000. Parameter block identifier. The base station shall set this field to the value of the parameter block type being downloaded (see Table 4.5.3-1).

BLOCK_LEN

Parameter block length. The base station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields.

PARAM_DATA

Parameter data. The base station shall include the parameter block specified by the BLOCK_ID field. If Secure Mode is active (see 4.3.5), PARAM_DATA field shall be encrypted as specified in 4.3.5.

FRESH_INCL

FRESH included indicator. If Secure Mode is active (See 4.3.5), the base station shall set this field to 1; otherwise the base station shall set this field to 0.

FRESH

Cryptographic Synchronizer (crypto-sync) encrypting PARAM_DATA field of the message.

selected

for

If FRESH_INCL = 1, the base station shall include this field and set it to a 15-bit value chosen as specified in 4.3.5 for encrypting the PARAM_DATA field of the Parameter Data block included in the message; otherwise the base station shall omit this field. RESERVED Reserved bits. If FRESH_INCL = 1, the base station shall omit this field; otherwise, the base station shall set all the bits of this field to 0.

4-20

3GPP2 C.S0016-D v2.0

2 3

4.5.1.10 Validation Request Message The Validation Request Message has the following variable-length format: Field OTASP_MSG_TYPE (00001001) NUM_BLOCKS 8 8 Length (bits)

NUM_BLOCKS occurrences of the following parameter block: BLOCK_ID BLOCK_LEN PARAM_DATA

4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

8 8 8 BLOCK_LEN

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The base station shall set this field to 00001001. Number of parameter blocks. The base station shall set this field to the number of parameter blocks contained in the Validation Request Message.

BLOCK_ID

Parameter block identifier. The base station shall set this field to the value of the parameter block type being included in the message (see Table 4.5.4-1).

BLOCK_LEN

Parameter block length. The base station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields.

PARAM_DATA

Parameter data fields. The base station shall include the parameter block specified by the BLOCK_ID field.

4-21

3GPP2 C.S0016-D v2.0 4.5.1.11 OTAPA Request Message The OTAPA Request Message has the following fixed-length format: Field OTASP_MSG_TYPE (00001010) START_STOP RESERVED
3 4 5 6 7 8 9 10 11 12

1 2

Length (bits) 8 1 7

OTASP_MSG_TYPE START_STOP

OTASP Data Message type. The base station shall set this field to 00001010. OTAPA session start-stop indicator. The base station shall set this field to 1 to invoke the OTAPA session in the mobile station. The base station shall set this field to 0 to terminate the OTAPA session in the mobile station.

RESERVED

Reserved bits. The base station shall set this field to 0000000.

13 14 15

4.5.1.12 PUZL Configuration Request Message The PUZL Configuration Request Message has the following variable-length format: Field OTASP_MSG_TYPE (00001011) BLOCK_ID 8 8 Length (bits)

If BLOCK_ID = 00000001 (PUZL Priorities Parameter Block) or if BLOCK_ID = 00000010 (User Zone Parameter Block), the message also includes the following fields: UZ_COUNT 12

UZ_COUNT occurrences of the following two fields: UZ_ID UZ_SID 16 15

RESERVED
16 17 18 19

0 to 7

OTASP_MSG_TYPE BLOCK_ID

OTASP Data Message type. The base station shall set this field to 00001011. Parameter block identifier.

4-22

3GPP2 C.S0016-D v2.0 The base station shall set this field to the value of the BLOCK_ID of the parameter block being requested in this message [see Table 3.5.6-1]. If the BLOCK_ID field is set to 00000001 (PUZL Priorities Parameter Block) or set to 00000010 (User Zone Parameter Block), the base station shall include the following fields in the message: UZ_COUNT User Zone Count. The base station shall set this field to the number of UZ_ID and UZ_SID pairs contained in the PUZL Configuratoin Request Message. UZ_ID User Zone ID. Identification number for the User Zone. This is used over the air interface to identify the User Zone to the network and the mobile station. The UZ_ID values are defined based on Table 3.5.1.13-1. UZ_SID User Zone System ID. The System Identifier (SID) associated with the User Zone ID. The User Zone ID and User Zone SID values together provide a unique identifier for the user zone. RESERVED Reserved bits. The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

4-23

3GPP2 C.S0016-D v2.0 4.5.1.13 PUZL Download Request Message The PUZL Download Request Message has the following variable-length format: Field OTASP_MSG_TYPE (00001100) NUM_BLOCKS 8 8 Length (bits)

1 2 3

NUM_BLOCKS occurrences of the following parameter block: BLOCK_ID BLOCK_LEN PARAM_DATA 8 8 8 BLOCK_LEN

FRESH_INCL FRESH RESERVED

4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

1 0 or 15 0 or 7

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The base station shall set this field to 00001100. Number of parameter blocks. The base station shall set this field to the number of parameter blocks contained in the PUZL Download Request Message.

BLOCK_ID

Parameter block identifier. The base station shall set this field to the value of the parameter block type being included in the message (see Table 4.5.6-1).

BLOCK_LEN

Parameter block length. The base station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields.

PARAM_DATA

Parameter data fields. The base station shall include the parameter block specified by the BLOCK_ID field. If Secure Mode is active (see 4.3.5), PARAM_DATA fields shall be encrypted as specified in 4.3.5.

FRESH_INCL

FRESH included indicator. If Secure Mode is active (See 4.3.5), the base station shall set this field to 1; otherwise the base station shall set this field to 0.

FRESH

Cryptographic Synchronizer (crypto-sync) selected encrypting PARAM_DATA fields of the message.

for

4-24

3GPP2 C.S0016-D v2.0 If FRESH_INCL = 1, the base station shall include this field and set it to a 15-bit value chosen as specified in 4.3.5 for encrypting the PARAM_DATA fields of all Parameter Data blocks included in the message; otherwise the base station shall omit this field. RESERVED Reserved bits. If FRESH_INCL= 1, the base station shall omit this field; otherwise, the base station shall set all the bits of this field to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13

4.5.1.14 3GPD Configuration Request Message The 3GPD Configuration Request Message has the following format: Field OTASP_MSG_TYPE (00001101) NUM_BLOCKS 8 8 Length (bits)

NUM_BLOCKS occurrences of the following fields: BLOCK_ID

14 15 16 17 18 19 20 21 22 23 24 25

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The base station shall set this field to 00001101. Number of parameter blocks requested. The base station shall set this field to the number of parameter blocks requested.

The base station shall include NUM_BLOCKS occurrences of the following field: BLOCK_ID Parameter block identifier. The base station shall set this field to the value of the BLOCK_ID of the parameter block being requested in this message (see Table 3.5.8-1).

4-25

3GPP2 C.S0016-D v2.0 4.5.1.15 3GPD Download Request Message The 3GPD Download Request Message has the following variable-length format: Field OTASP_MSG_TYPE (00001110) NUM_BLOCKS 8 8 Length (bits)

1 2 3

NUM_BLOCKS occurrences of the following parameter block: BLOCK_ID BLOCK_LEN PARAM_DATA 8 8 8 BLOCK_LEN

FRESH_INCL FRESH RESERVED

4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

1 0 or 15 0 or 7

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The base station shall set this field to 00001110. Number of parameter blocks. The base station shall set this field to the number of parameter blocks contained in the 3GPD Download Request Message.

The base station shall include NUM_BLOCKS occurrences of the following fields: BLOCK_ID Parameter block identifier. The base station shall set this field to the value of the parameter block type being included in the message (see Table 4.5.7-1). BLOCK_LEN Parameter block length. The base station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields. PARAM_DATA Parameter data fields. The base station shall include the parameter block specified by the BLOCK_ID field. If Secure Mode is active (see 4.3.5), PARAM_DATA fields shall be encrypted as specified in 4.3.5. FRESH_INCL FRESH included indicator. If Secure Mode is active (See 4.3.5), the base station shall include this field and set it to 1; otherwise the base station shall set this field to 0.

4-26

3GPP2 C.S0016-D v2.0 FRESH Cryptographic Synchronizer (crypto-sync) selected encrypting PARAM_DATA fields of the message. for

1 2 3 4 5 6 7 8 9 10 11

If FRESH_INCL = 1, the base station shall include this field and set it to a 15-bit value chosen as specified in 4.3.5 for encrypting the PARAM_DATA fields of all Parameter Data blocks included in the message; otherwise the base station shall omit this field. RESERVED Reserved bits. If FRESH_INCL = 1, the base station shall omit this field; otherwise, the base station shall set all the bits of this field to 0. 4.5.1.16 Secure Mode Request Message The Secure Mode Request Message has the following fixed-length format: Field OTASP_MSG_TYPE (00001111) START_STOP KEY_IN_USE RESERVED RAND_SM 8 1 4 3 0 or 64 Length (bits)

12 13

14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

OTASP_MSG_TYPE START_STOP

OTASP Data Message type. The base station shall set this field to 00001111. Secure Mode start-stop indicator. The base station shall set this field to 1 to invoke the Secure Mode in the mobile station. The base station shall set this field to 0 to terminate the Secure Mode in the mobile station.

KEY_IN_USE

Key in use indicator. If the START_STOP is set to 1, the base station shall set this field to 0000 to indicate SMCK generation using SSD_A and SSD_B, or 0001 to indicate SMCK generation using 3G Root Key, otherwise, this field shall be set to 0000.

RESERVED RAND_SM

Reserved bits. The base station shall set this field to 000. Random Number used for SMCK generation. If the START_STOP is set to 1, the base station shall set this field to a randomly selected 64-bit value used for generation of the SMCK. If the START_STOP is set to 0, the base station shall omit this field.

4-27

3GPP2 C.S0016-D v2.0 4.5.1.17 Reserved This section was reserved for an Extended Protocol Capability Request Message. However, the Protocol Capability Request Message is used instead.

1 2 3 4 5 6 7

4.5.1.18 MMD Configuration Request Message The MMD Configuration Request Message has the following format: Field OTASP_MSG_TYPE (00010001) NUM_BLOCKS 8 8 Length (bits)

NUM_BLOCKS occurrences of the following fields: BLOCK_ID

8 9 10 11 12 13 14 15 16 17 18 19

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The base station shall set this field to 00010001. Number of parameter blocks requested. The base station shall set this field to the number of parameter blocks requested.

The base station shall include NUM_BLOCKS occurrences of the following field: BLOCK_ID Parameter block identifier. The base station shall set this field to the value of the BLOCK_ID of the parameter block being requested in this message (see Table 3.5.9-1).

4-28

3GPP2 C.S0016-D v2.0 4.5.1.19 MMD Download Request Message The MMD Download Request Message has the following variable-length format: Field OTASP_MSG_TYPE (00010010) NUM_BLOCKS 8 8 Length (bits)

1 2 3

NUM_BLOCKS occurrences of the following parameter block: BLOCK_ID BLOCK_LEN PARAM_DATA 8 8 8 BLOCK_LEN

FRESH_INCL FRESH RESERVED

4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

1 0 or 15 0 or 7

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The base station shall set this field to 00010010. Number of parameter blocks. The base station shall set this field to the number of parameter blocks contained in the MMD Download Request Message.

BLOCK_ID

Parameter block identifier. The base station shall set this field to the value of the parameter block type being included in the message (see Table 4.5.8-1).

BLOCK_LEN

Parameter block length. The base station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields.

PARAM_DATA

Parameter data fields. The base station shall include the parameter block specified by the BLOCK_ID field. If Secure Mode is active (see 4.3.5), PARAM_DATA fields shall be encrypted as specified in 4.3.5.

FRESH_INCL

FRESH included indicator. If Secure Mode is active (See 4.3.5), the base station shall set this field to 1; otherwise the base station shall set this field to 0.

FRESH

Cryptographic Synchronizer (crypto-sync) selected encrypting PARAM_DATA fields of the message.

for

4-29

3GPP2 C.S0016-D v2.0 If FRESH_INCL = 1, the base station shall include this field and set it to a 15-bit value chosen as specified in 4.3.5 for encrypting the PARAM_DATA fields of all Parameter Data blocks included in the message; otherwise the base station shall omit this field. RESERVED Reserved bits. If FRESH_INCL= 1, the base station shall omit this field; otherwise, the base station shall set all the bits of this field to 0.

1 2 3 4 5 6 7 8 9 10

11 12 13 14

4.5.1.20 System Tag Configuration Request Message The System Tag Configuration Request Message shall have the following variable-length format: Field OTASP_MSG_TYPE (00010011) BLOCK_ID 8 8 Length (bits)

If BLOCK_ID = 00000001 (System Tag List Parameter Block), the message also includes the following fields: REQUEST_OFFSET REQUEST_MAX_SIZE
15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

16 8

OTASP_MSG_TYPE BLOCK_ID

OTASP Data Message type. The base station shall set this field to 00010011. Parameter block identifier. The base station shall set this field to the value of the BLOCK_ID of the parameter block being requested in this message (see Table 3.5.10-1).

If the BLOCK_ID field is set to 00000001 (System Tag List Parameter Block), the base station shall include the following fields in the message: REQUEST_OFFSET Segment offset. The base station shall set this field to the starting offset within the group tag list (GROUP_TAG_ LISTs-p), specific tag list (SPEC_TAG_ LISTs-p), or call prompt list (CALL_PRMPT_ LISTs-p) of the octets being requested. REQUEST_MAX_SIZE Maximum segment size. The base station shall set this field to the maximum number of system tag list octets that the mobile station is to return.

4-30

3GPP2 C.S0016-D v2.0 4.5.1.21 System Tag Download Request Message The System Tag Download Request Message shall have the following format Field OTASP_MSG_TYPE (00010100) BLOCK_ID BLOCK_LEN PARAM_DATA
3 4 5 6 7 8 9 10 11 12 13 14

1 2

Length (bits) 8 8 8 8 BLOCK_LEN

OTASP_MSG_TYPE BLOCK_ID

OTASP Data Message type. The base station shall set this field to 00010100. Parameter block identifier. The base station shall set this field to the value of the parameter block type being downloaded (see Table 4.5.9-1).

BLOCK_LEN

Parameter block length. The base station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields.

PARAM_DATA

Parameter data. The base station shall include the parameter block specified by the BLOCK_ID field.

15

16 17

4.5.1.22 Service Key Generation Request Message The Service Key Generation Request Message has the following fixed-length format: Field OTASP_MSG_TYPE (00010101) KEY_ID RESERVED 8 12 4 Length (bits)

18 19 20 21 22 23 24

OTASP_MSG_TYPE KEY_ID

OTASP Data Message type. The base station shall set this field to 00010101. Key exchange identifier. The base station shall set this field corresponding to the key requested as shown in Table 4.5.1.22-1 in the form of a bitmap; otherwise, the base station shall omit this field.

4-31

3GPP2 C.S0016-D v2.0 Table 4.5.1.22-1 Key Identifier Table Subfield Length (bits) IMS Root Key BCMCS Root Key WLAN Root Key RESERVED
2 3 4

1 1 1 9

RESERVED

Reserved bits. The base station shall set this field to 0000.

5 6 7

4.5.1.23 MMS Configuration Request Message The MMS Configuration Request Message has the following format: Field OTASP_MSG_TYPE (00010110) NUM_BLOCKS 8 8 Length (bits)

NUM_BLOCKS occurrences of the following fields: BLOCK_ID

8 9 10 11 12 13 14 15 16 17 18

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The base station shall set this field to 00010110. Number of parameter blocks requested. The base station shall set this field to the number of parameter blocks requested.

The base station shall include NUM_BLOCKS occurrences of the following field: BLOCK_ID Parameter block identifier. The base station shall set this field to the value of the BLOCK_ID of the parameter block being requested in this message (see Table 3.5.12-1).

4-32

3GPP2 C.S0016-D v2.0 4.5.1.24 MMS Download Request Message The MMS Download Request Message has the following variable-length format: Field OTASP_MSG_TYPE (00010111) NUM_BLOCKS 8 8 Length (bits)

1 2 3

NUM_BLOCKS occurrences of the following parameter block: BLOCK_ID BLOCK_LEN PARAM_DATA 8 8 8 BLOCK_LEN

FRESH_INCL FRESH RESERVED

4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

1 0 or 15 0 or 7

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The base station shall set this field to 00010111. Number of parameter blocks. The base station shall set this field to the number of parameter blocks contained in the MMS Download Request Message.

BLOCK_ID

Parameter block identifier. The base station shall set this field to the value of the parameter block type being included in the message (see Table 4.5.10-1).

BLOCK_LEN

Parameter block length. The base station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields.

PARAM_DATA

Parameter data fields. The base station shall include the parameter block specified by the BLOCK_ID field. If Secure Mode is active (see 4.3.5), PARAM_DATA fields shall be encrypted as specified in 4.3.5.

FRESH_INCL

FRESH included indicator. If Secure Mode is active (See 4.3.5), the base station shall set this field to 1; otherwise the base station shall set this field to 0.

FRESH

Cryptographic Synchronizer (crypto-sync) selected encrypting PARAM_DATA fields of the message.

for

4-33

3GPP2 C.S0016-D v2.0 If FRESH_INCL = 1, the base station shall include this field and set it to a 15-bit value chosen as specified in 4.3.5 for encrypting the PARAM_DATA fields of all Parameter Data blocks included in the message; otherwise the base station shall omit this field. RESERVED Reserved bits. If FRESH_INCL= 1, the base station shall omit this field; otherwise, the base station shall set all the bits of this field to 0.

1 2 3 4 5 6 7 8 9 10

11 12 13

4.5.1.25 MMSS Configuration Request Message The MMSS Configuration Request Message has the following variable-length format:

Field OTASP_MSG_TYPE (00011000) NUM_BLOCKS

Length (bits) 8 8

NUM_BLOCKS occurrences of the following confirmation block: BLOCK_ID REQUEST_OFFSET REQUEST_MAX_SIZE

14

8 0 or 16 0 or 8

15 16 17 18 19 20 21 22 23 24 25 26 27 28

OTASP_MSG_TYPE NUM_BLOCKS

OTASP Data Message type. The base station shall set this field to 00011000. Number of parameter blocks. The base station shall set this field to the number of parameter blocks contained in the MMSS Configuration Request Message that is being confirmed in Table 3.5.13-1.

BLOCK_ID

Parameter block identifier. The base station shall set this field to the value of the BLOCK_ID field of the corresponding parameter block in the MMSS Configuration Response Message that is being confirmed (see Table 3.5.13-1).

If BLOCK_ID = 00000010 (MMSS Location Associated Priority List), the message shallalso includes the following fields: REQUEST_OFFSET Segment offset.

4-34

3GPP2 C.S0016-D v2.0 The base station shall set this field to the starting offset within the MMSS Location Associated Priority list (MLP_LISTs-p) of the octets being requested. REQUEST_MAX_SIZE Maximum segment size. The base station shall set this field to the maximum number of MMSS Location Associated Priority list octets that the mobile station is to return.

1 2 3 4 5 6 7 8

9 10 11 12 13 14 15 16 17 18 19

If the BLOCK_ID field is set to 00000011 (MMSS System Priority List), the base station shall include the following fields in the message: REQUEST_OFFSET Segment offset. The base station shall set this field to the starting offset within the MMSS System Priority list (MSP_LISTs-p) of the octets being requested. REQUEST_MAX_SIZE Maximum segment size. The base station shall set this field to the maximum number of MMSS System Priority list octets that the mobile station is to return.

20 21 22

4.5.1.26 MMSS Download Request Message The MMSS Download Request Message has the following variable-length format:

Field OTASP_MSG_TYPE (00011001) NUM_BLOCKS

Length (bits) 8 8

NUM_BLOCKS occurrences of the following confirmation block: BLOCK_ID BLOCK_LEN PARAM_DATA SEGMENT_OFFSET SEGMENT_DATA
23

8 8 8 x BLOCK_LEN 16 8 x BLOCK_LEN

FRESH_INCL FRESH RESERVED

1 0 or 15 0 or 7

4-35

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

OTASP_MSG_TYPE NUM_BLOCKS -

OTASP Data Message type. The base station shall set this field to 00011001. Number of parameter blocks. The base station shall set this field to the number of parameter blocks contained in the MMSS Download Request Message that is being confirmed.

BLOCK_ID

Parameter block identifier. The base station shall set this field to the value of the BLOCK_ID field of the corresponding parameter block in the MMSS Download Request Message that is being confirmed (see Table 4.5.11-1).

BLOCK_LEN

Parameter block length. The base station shall set this field to the number of octets in the parameter block, not including the BLOCK_ID and BLOCK_LEN fields.

If the BLOCK_ID field is set to 00000001 (MMSS Location Associated Priority List), the base station shall include the following fields in the message: SEGMENT_OFFSET Segment offset. The base station shall set this field to the starting offset, within the MMSS Location Assiocated Priority List (MLPL) at which the mobile station is to store the octets included in SEGMENT_DATA. SEGMENT_DATA Segment data. The base station shall set this field to sequential octets of the MLPL. The octets shall be those starting at the offset within the MLPL specified by SEGMENT_OFFSET.

If the BLOCK_ID field is set to 00000010 (MMSS System Priority List), the base station shall include the following fields in the message: SEGMENT_OFFSET Segment offset. The base station shall set this field to the starting offset, within the MMSS System Priority List (MSPL) at which the mobile station is to store the octets included in SEGMENT_DATA. SEGMENT_DATA Segment data. The base station shall set this field to sequential octets of the MSPL. The octets shall be those starting at the offset within the MSPL specified by SEGMENT_OFFSET.

4-36

3GPP2 C.S0016-D v2.0 PARAM_DATA Parameter block data. If the BLOCK_ID field is set to 00000001 (MMSS Location Associated Priority List) or 00000010 (MMSS System Priority List), then the base station shall include the fields defined in the table below. Otherwise, Tthe base station shall include the parameter block specified by the BLOCK_ID field as specified in 4.5.11. If SECURE_MODE_INDS = 1, PARAM_DATA fields shall be encrypted as specified in section 4.3.53.3.8. Field RESERVED LAST_SEGMENT SEGMENT_OFFSET SEGMENT_SIZE SEGMENT_DATA
11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35

1 2 3 4 5 6 7 8 9 10

Length (bits) 7 1 16 8 8 SEGMENT_SIZE

RESERVED LAST_SEGMENT

Reserved bits (in PARAM_DATA). The base station shall set this field to 0000000. Last segment indicator bit (in PARAM_DATA). The base station shall set this field to 1 if SEGMENT_DATA contains the last octet of the MMSS Location Assiocated Priority List (MLP_LISTS-P) or MMSS System Priority List (MSP_LISTS-P) sent to the mobile station; otherwise, the base station shall set this field to 0. The MLP_LISTS-P and MSP_LISTS-P is defined in Sec. 4.5.11.2 (MMSS Location Associated Priority List) and 4.5.11.3 (MMSS System Priority List).

SEGMENT_OFFSET

Segment offset (in PARAM_DATA). The base station shall set this field to the starting offset, within the MLP_LISTS-P or MSP_LISTS-P at which the mobile station is to store the octets included in SEGMENT_DATA.

SEGMENT_SIZE

Segment size (in PARAM_DATA). The base station shall set this field to the number of octets of MLP_LISTS-P or MSP_LISTS-P included in SEGMENT_DATA.

SEGMENT_DATA

Segment data (in PARAM_DATA). If the BLOCK_ID field is set to 00000001 (MMSS Location Associated Priority List), then the base station shall set this field to sequential octets of the MLP_LISTS-P. The octets shall be those starting at the offset within the MLP_LISTS-P specified by SEGMENT_OFFSET.

4-37

3GPP2 C.S0016-D v2.0 If the BLOCK_ID field is set to 00000010 (MMSS System Priority List), then the base station shall set this field to sequential octets of the MSP_LISTS-P. The octets shall be those starting at the offset within the MSP_LISTS-P specified by SEGMENT_OFFSET. FRESH_INCL FRESH included indicator. If SECURE_MODE_INDS = 1, the base station shall set this field to 1; otherwise the base station shall set this field to 0. FRESH Cryptographic Synchronizer (crypto-sync) selected encrypting PARAM_DATA fields of the message. for

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

If FRESH_INCL = 1, the base station shall include this field and set it to a 15-bit value chosen according to requirements defined in Section 3.3.8 for encrypting the PARAM_DATA fields of all Parameter Data blocks included in the message; otherwise the base station shall omit this field. RESERVED Reserved bits. If FRESH_INCL = 1, the base station shall omit this field; otherwise, the mobile station shall set all the bits of this field to 0.

22 23 24 25

4.5.2 NAM Parameter Blocks Table 4.5.2-1 lists the types of parameter blocks used in the Download Request Message and the Download Response Message. Table 4.5.2-1 NAM Parameter Block Types Parameter Block Type CDMA/Analog NAM Download Mobile Directory Number CDMA NAM Download IMSI_T eHRPD IMSI Download Reserved for future standardization BLOCK_ID 00000000 00000001 00000010 00000011 00000100 00000101 through 01111111 10000000 through 11111110 11111111 See [4] Reference 4.5.2.1 4.5.2.2 4.5.2.3 4.5.2.4 4.5.2.5

Available for manufacturer-specific parameter block definitions Reserved

26

4-38

3GPP2 C.S0016-D v2.0 4.5.2.1 CDMA/Analog NAM Download The PARAM_DATA field of the CDMA/Analog NAM Download Parameter Block consists of the following fields: Field FIRSTCHP HOME_SID EX IMSI_M_CLASS IMSI_M_ADDR_NUM MCC_M IMSI_M_11_12 IMSI_M_S ACCOLC LOCAL_CONTROL_ANALOG MOB_TERM_HOME MOB_TERM_FOR_SID MOB_TERM_FOR_NID N_SID_NID 11 15 1 1 3 10 7 34 4 1 1 1 1 8 Length (bits)

1 2 3

N_SID_NID occurrences of the following SID/NID pair: SID NID 15 16

The parameter block ends with the following field: RESERVED

4 5 6 7 8 9 10 11 12 13 14

0 to 7 (as needed)

FIRSTCHP

First paging channel used in the home system. The base station shall set this field to the value for the FIRSTCHPp mobile station NAM indicator (see F.3 of [1, 1]).

HOME_SID

Home system identification. The base station shall set this field to the value for the HOME_SIDp mobile station NAM indicator (see F.3 of [1, 1]).

EX

Extended address indicator. The base station shall set this field to the value for the EXp mobile station NAM indicator (see F.3 of [1, 1]).

IMSI_M_CLASS

IMSI_M Class assignment of the mobile station.

4-39

3GPP2 C.S0016-D v2.0 If the base station is assigning a class 0 IMSI_M to the mobile station, the base station shall set this field to 0; otherwise the base station shall set this field to 1. IMSI_M_ADDR_NUM Number of IMSI_M address digits. If the mobile station has been assigned a class 1 IMSI_M (see 6.3.1 of [1] or 2.3.1 of [1]), the base station shall set this field to four less than the number of digits in the NMSI; otherwise, the base station shall set this field to 000. MCC_M Mobile country code of the IMSI_M. The base station shall set this field to the value for the MCC_Mp mobile station NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]). IMSI_M_11_12 11th and 12th digits of the IMSI_M. The base station shall set this field to the value for the IMSI_M_11_12p mobile station NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]. IMSI_M_S The least significant 10 digits of the IMSI_M. The base station shall set this field to the value for the IMSI_M_Sp mobile station NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]). ACCOLC Access overload class. The base station shall set this field to the value for the ACCOLCp mobile station NAM indicator (see F.3 of [1, 1]). The base station shall set APersistence[i] (for mobile stations that also support HRPD) as shown in Table 3.5.2.1-1 when ACCOLC is set. LOCAL_CONTROL_ANALOG Local control status for Analog operation. The base station shall set this field to 1 to enable local control status for Analog operation in the mobile station, or to 0 to disable local control status (see 2.6.1.2.2 of [1]). MOB_TERM_HOME Termination indicator for the home system. The base station shall set this field to the value for the MOB_TERM_HOMEp mobile station NAM indicator (see F.3 and 6.6.5.3 of [1] or F.3 and 2.6.5.3 of [1]). MOB_TERM_FOR_SID Termination indicator for SID roaming. The base station shall set this field to the value for the MOB_TERM_FOR_SIDp mobile station NAM indicator (see F.3 and 6.6.5.3 of [1] or F.3 and 2.6.5.3 of [1]). MOB_TERM_FOR_NID Termination indicator for NID roaming. The base station shall set this field to the value for the MOB_TERM_FOR_NIDp mobile station NAM indicator (see F.3 and 6.6.5.3 of [1] or F.3 and 2.6.5.3 of [1]).

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43

4-40

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

N_SID_NID

Number of SID/NID pairs. The base station shall set this field to the number of SID/NID pairs included in the parameter block. The base station shall include at least one SID/NID pair.

SID

System identification. The base station shall set this field to the value of the SID component of the SID/NID pair (see F.3 of [1, 1]).

NID

Network identification. The base station shall set this field to the value of the NID component of the SID/NID pair (see F.3 of [1, 1]).

RESERVED

Reserved bits. The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

17 18 19

4.5.2.2 Mobile Directory Number The PARAM_DATA field of the Mobile Directory Number Parameter Block consists of the following fields: Field N_DIGITS 4 Length (bits)

N_DIGITS occurrences of the following field: DIGITn 4

The parameter block ends with the following field: RESERVED

20 21 22 23 24 25 26 27 28 29 30 31 32 33

0 or 4

N_DIGITS

Number of digits. The base station shall set this field to the number of digits included in the parameter block.

DIGITn

Digit. The base station shall set these fields to the digits of the mobile station directory number. Each digit shall be encoded according to Table 6.7.1.3.2.4-4 of [1] or Table 2.7.1.3.2.4-4 of [1].

RESERVED

Reserved bits. The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

4-41

3GPP2 C.S0016-D v2.0 4.5.2.3 CDMA NAM Download The PARAM_DATA field of the CDMA NAM Download Parameter Block consists of the following fields: Field IMSI_M_CLASS IMSI_M_ADDR_NUM MCC_M IMSI_M_11_12 IMSI_M_S ACCOLC LOCAL_ CONTROL_CDMA MOB_TERM_HOME MOB_TERM_FOR_SID MOB_TERM_FOR_NID N_SID_NID 1 3 10 7 34 4 1 1 1 1 8 Length (bits)

1 2 3

N_SID_NID occurrences of the following SID/NID pair: SID NID 15 16

The parameter block ends with the following field: RESERVED

4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

0 to 7 (as needed)

IMSI_M_CLASS

IMSI_M Class assignment of the mobile station. If the base station is assigning a class 0 IMSI_M to the mobile station, the base station shall set this field to 0; otherwise the base station shall set this field to 1.

IMSI_M_ADDR_NUM

Number of IMSI_M address digits. If the mobile station has been assigned a class 1 IMSI_M (see 6.3.1 of [1] or 2.3.1 of [1]), the base station shall set this field to four less than the number of digits in the NMSI; otherwise, the base station shall set this field to 000.

MCC_M

Mobile country code of the IMSI_M. The base station shall set this field to the value for the MCC_Mp mobile station NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]).

IMSI_M_11_12

11th and 12th digits of the IMSI_M.

4-42

3GPP2 C.S0016-D v2.0 The base station shall set this field to the value for the IMSI_M_11_12p mobile station NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]). IMSI_M_S The least significant 10 digits of the IMSI_M. The base station shall set this field to the value for the IMSI_M_Sp mobile station NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]). ACCOLC Access overload class. The base station shall set this field to the value for the ACCOLCp mobile station NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]). The base station shall set APersistence[i] (for mobile stations that also support HRPD) as shown in Table 3.5.2.1-1 when ACCOLC is set. LOCAL_ CONTROL_CDMA Local control status for CDMA operation. The base station shall set this field to 1 to enable local control status for CDMA operation in the mobile station, or to 0 to disable local control status (see 6.3.9 of [1] or 2.3.9 of [1]). MOB_TERM_HOME Termination indicator for the home system. The base station shall set this field to the value for the MOB_TERM_HOMEp mobile station NAM indicator (see F.3 and 6.6.5.3 of [1] or F.3 and 2.6.5.3 of [1]). MOB_TERM_FOR_SID Termination indicator for SID roaming. The base station shall set this field to the value for the MOB_TERM_FOR_SIDp mobile station NAM indicator (see F.3 and 6.6.5.3 of [1] or F.3 and 2.6.5.3 of [1]). MOB_TERM_FOR_NID Termination indicator for NID roaming. The base station shall set this field to the value for the MOB_TERM_FOR_NIDp mobile station NAM indicator (see F.3 and 6.6.5.3 of [1] or F.3 and 2.6.5.3 of [1]). N_SID_NID Number of SID/NID pairs. The base station shall set this field to the number of SID/NID pairs included in the parameter block. The base station shall include at least one SID/NID pair. SID System identification. The base station shall set this field to the value of the SID component of the SID/NID pair (see F.3 of [1, 1]). NID Network identification. The base station shall set this field to the value of the NID component of the SID/NID pair (see F.3 of [1, 1]). RESERVED Reserved bits.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

4-43

3GPP2 C.S0016-D v2.0 The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0. 4.5.2.4 IMSI_T Parameter Block The PARAM_DATA field of the IMSI_T Parameter Block consists of the following fields:

1 2 3 4

5 6

Field IMSI_T_CLASS IMSI_T_ADDR_NUM MCC_T IMSI_T_11_12 IMSI_T_S RESERVED

8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

Length (bits) 1 3 10 7 34 1

IMSI_T_CLASS

IMSI_T Class assignment of the mobile station. If the base station is assigning a class 0 IMSI_T to the mobile station, the base station shall set this field to 0; otherwise the base station shall set this field to 1.

IMSI_T_ADDR_NUM

Number of IMSI_T address digits. If the mobile station has been assigned a class 1 IMSI_T (see 6.3.1 of [1] or 2.3.1 of [1]), the base station shall set this field to four less than the number of digits in the NMSI; otherwise, the base station shall set this field to 000.

MCC_T

Mobile country code of the IMSI_T. The base station shall set this field to the value for the MCC_Tp mobile station NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]).

IMSI_T_11_12

11th and 12th digits of the IMSI_T. The base station shall set this field to the value for the IMSI_T_11_12p mobile station NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1])).

IMSI_T_S

The least significant 10 digits of the IMSI_T. The base station shall set this field to the value for the IMSI_T_Sp mobile station NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]).

RESERVED

Reserved bits. The base station shall set this field to 0.

4-44

3GPP2 C.S0016-D v2.0 4.5.2.5 eHRPD IMSI Download The PARAM_DATA field of the eHRPD IMSI Download Parameter Block consists of the following fields: Field eHRPD_MNC_NUM_DIGITS eHRPD_IMSI_NUM_DIGITS RESERVED eHRPD_IMSI_DIGITS RESERVED
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

1 2 3

Length (bits) 1 4 3 4 * eHRPD_IMSI_NUM_DIGITS 0 to 4 bits as needed

eHRPD_MNC_NUM_DIGITS - Number of Mobile Network Code Digits. If the number of MNC digits in the eHRPD IMSI is 2, the value of this field is set to 0. Otherwise, it is set to 1 to indicate an MNC with 3 digits in the eHRPD IMSI. RESERVED Reserved bits. The base station shall set this field to 000. eHRPD_IMSI_NUM_DIGITS - Number of eHRPD International Mobile Station Identity Digits The base station shall set this field to the number of digits in eHRPD_IMSI. eHRPD_IMSI_DIGITS eHRPD International Mobile Station Identity Digits The base station shall set this field to the eHRPD IMSI using BCD encoding wherein each digit is represented by 4 bits. Digits are included in sequence starting with the most significant digit.13 RESERVED Reserved bits. The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

13 For example, given the eHRPD IMSI 001 02 0123456789, eHRPD_MNC_NUM_DIGITS is 0,

eHRPD_IMSI_NUM_DIGITS is 1111, and eHRPD_IMSI_DIGITS is 0000 0000 0001 0000 0010 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 where spaces between digits and bits have been added for clarity.

4-45

3GPP2 C.S0016-D v2.0 4.5.3 SSPR Parameter Blocks Table 4.5.3-1 lists the type of the parameter blocks used in the SSPR Download Request Message and the SSPR Download Response Message. Table 4.5.3-1 SSPR Parameter Block Types Parameter Block Type Preferred Roaming List Extended Preferred Roaming List with SSPR_P_REV greater than 00000001 Reserved for future standardization BLOCK_ID 00000000 00000001 00000010 through 01111110 01111111 01111111 10000000 through 11111110 11111111 1.2.3 See [4] Reference 4.5.3.1 4.5.3.1

1 2 3 4

NULLPRL_BLOCK_ID Available for manufacturer-specific parameter block definitions Reserved

5

6 7 8 9

4.5.3.1 Preferred Roaming List Parameter Block The PARAM_DATA field of the Preferred Roaming List and Extended Preferred Roaming List Parameter Block consists of the following fields: Field RESERVED LAST_SEGMENT SEGMENT_OFFSET SEGMENT_SIZE SEGMENT_DATA 7 1 16 8 8 SEGMENT_SIZE Length (bits)

10 11 12 13 14 15 16 17 18

RESERVED LAST_SEGMENT

Reserved bits. The base station shall set this field to 0000000. Last segment indicator bit. The base station shall set this field to 1 if SEGMENT_DATA contains the last octet of the preferred roaming list (PR_LISTs-p) sent to the mobile station; otherwise, the base station shall set this field to 0.

SEGMENT_OFFSET

Segment offset.

4-46

3GPP2 C.S0016-D v2.0 The base station shall set this field to the starting offset, within the preferred roaming list at which the mobile station is to store the octets included in SEGMENT_DATA. SEGMENT_SIZE Segment size. The base station shall set this field to the number of octets of the preferred roaming list included in SEGMENT_DATA. SEGMENT_DATA Segment data. This field contains SEGMENT_SIZE octets starting at the offset specified by SEGMENT_OFFSET within the preferred roaming list.The base station shall set this field to sequential octets of the preferred roaming list. The octets shall be those starting at the offset within the preferred roaming list specified by SEGMENT_OFFSET.

1 2 3 4 5 6 7 8 9 10 11 12 13 14

15 16 17 18 19

4.5.4 Validation Parameter Blocks Table 4.5.4-1 lists the types of parameter blocks used in the Validation Request Message and the Validation Response Message.

Table 4.5.4-1 Validation Parameter Block Types Parameter Block Type Verify SPC Change SPC Validate SPASM Reserved for future standardization BLOCK_ID 00000000 00000001 00000010 00000011 through 01111111 10000000 through 11111110 11111111 See [4] Reference 4.5.4.1 4.5.4.2 4.5.4.3

Available for manufacturer-specific parameter block definitions Reserved

20

21 22 23

4.5.4.1 Verify SPC The PARAM_DATA field of the Verify SPC Parameter Block consists of the following field: Field SPC 24 Length (bits)

24

4-47

3GPP2 C.S0016-D v2.0 SPC Service programming code. The base station shall set this field to the BCD coded value of Service Programming Code assigned for the mobile station (see Table 3.3.6-1). Each digit shall be encoded according to the Table 4.5.4.1-1.

1 2 3 4 5 6 7

Table 4.5.4.1-1. BCD Mapping Decimal Digit 0 1 2 3 4 5 6 7 8 9 Binary Number 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001

9 10 11

4.5.4.2 Change SPC The PARAM_DATA field of the Change SPC Parameter Block consists of the following field: Field SPC 24 Length (bits)

12 13 14 15 16 17

SPC

Service programming code The base station shall set this field to the BCD coded value of newly assigned Service Programming Code for the mobile station (see Table 3.3.6-1). Each digit shall be encoded according to the Table 4.5.4.1-1.

4-48

3GPP2 C.S0016-D v2.0 4.5.4.3 Validate SPASM The PARAM_DATA field of the Validate SMASM SPASM Parameter Block consists of the following fields: Field AUTH_OTAPA_INCL AUTH_OTAPA NAM_LOCK RESERVED
5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

1 2 3 4

Length (bits) 1 0 or 18 1 4 or 6

AUTH_OTAPA_INCL

OTAPA SPASM validation signature included indicator. The base station shall set this field to 1 to indicate that the OTAPA SPASM validation signature, AUTH_OTAPA, is included in the message; otherwise, the base station shall set this field to 0.

AUTH_OTAPA

OTAPA SPASM validation signature. If the AUTH_OTAPA_INCL is set to 1, the base station shall set this field as described in 3.3.7; otherwise, the base station shall omit this field.

NAM_LOCK

SPASM protection indicator for the active NAM. The base station shall set this field to 1 to activate SPASM protection of programmable parameters and indicators of the active NAM after completion of the current OTAPA session, otherwise the base station shall set this field to 0.

RESERVED

Reserved bits. The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

26 27 28

4.5.5 Reserved Reserved.

29 30 31

4.5.6 PUZL Parameter Blocks Table 4.5.6-1 lists the types of parameter blocks used in the PUZL Download Request Message and the PUZL Download Response Message.

4-49

3GPP2 C.S0016-D v2.0 Table 4.5.6-1 PUZL Parameter Block Types Parameter Block Type User Zone Insert User Zone Update User Zone Delete User Zone Priority Change PUZL Flags Reserved for future standardization BLOCK_ID 00000000 00000001 00000010 00000011 00000100 00000101 through 01111111 Available for manufacturer-specific parameter block definitions 10000000 through 11111110 Reserved
2

Reference 4.5.6.1 4.5.6.1 4.5.6.2 4.5.6.3 4.5.6.4

See [4]

11111111

3 4 5 6

4.5.6.1 User Zone Insert and User Zone Update The PARAM_DATA field of the User Zone Insert and User Zone Update Parameter Blocks consists of the following fields: Field UZ_ID UZ_SID LAST_SEGMENT SEGMENT_SEQ SEGMENT_SIZE SEGMENT_DATA 16 15 1 8 8 8 SEGMENT_SIZE Length (bits)

7 8 9 10 11 12 13 14 15 16

UZ_ID

User Zone ID. Identification number for the User Zone. This is used over the air interface to identify the User Zone to the network and the mobile station. The UZ_ID values are defined based on Table 3.5.1.13-1.

UZ_SID

User Zone System ID. The System Identifier (SID) associated with the User Zone ID. The User Zone ID and User Zone SID values together provide a unique identifier for the user zone.

4-50

3GPP2 C.S0016-D v2.0 LAST_SEGMENT Last segment indicator bit. The base station shall set this field to 1 if SEGMENT_DATA contains the last octet of the user zone entry; otherwise, the base station shall set this field to 0. SEGMENT_SEQ Segment sequence number. The base station shall set this field to the sequence number of each segment starting from 00000000 with the sequence number incremented by 1 for each subsequent segment. SEGMENT_SIZE Segment size. The base station shall set this field to the number of octets of the user zone included in SEGMENT_DATA. SEGMENT_DATA Segment data. Segment of the user zone data.

1 2 3 4 5 6 7 8 9 10 11 12 13 14

15 16 17 18

4.5.6.2 User Zone Delete The PARAM_DATA field of the User Zone Delete Parameter Block consists of the following fields: Field UZ_ID UZ_SID RESERVED Length (bits) 16 15 1

19 20 21 22 23 24 25 26 27 28 29 30 31

UZ_ID

User Zone ID. Identification number for the User Zone. This is used over the air interface to identify the User Zone to the network and the mobile station. The UZ_ID values are defined based on Table 3.5.1.13-1.

UZ_SID

User Zone System ID. The System Identifier (SID) associated with the User Zone ID. The User Zone ID and User Zone SID values together provide a unique identifier for the user zone.

RESERVED

Reserved bit. The base station shall set this field to 0.

32 33 34

4.5.6.3 User Zone Priority Change The PARAM_DATA field of the User Zone Priority Change Parameter Block consists of the following fields:

4-51

3GPP2 C.S0016-D v2.0

Field UZ_ID UZ_SID UZ_PRIORITY RESERVED

2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38

Length (bits) 16 15 4 5

UZ_ID

User Zone ID. Identification number for the User Zone. This is used over the air interface to identify the User Zone to the network and the mobile station. The UZ_ID values are defined based on Table 3.5.1.13-1.

UZ_SID

User Zone System ID. The System Identifier (SID) associated with the User Zone ID. The User Zone ID and User Zone SID values together provide a unique identifier for the user zone.

UZ_PRIORITY

User Zone priority. This field indicates the priority level of a user zone. When more than one UZ is available, the UZ with the highest priority that is not NULLUZ_PRIORITY takes precedence. A lower value indicates a higher priority; that is UZ_PRIORITY='0000' has a higher priority than UZ_PRIORITY='0001'. A priority of NULLUZ_PRIORITY indicates that a User Zone is for manual selection only. Note: UZ_PRIORITY is not unique; two or more UZs can have the same priority. This field indicates the priority level of a user zone. When more than one UZ is available, the UZ with the highest priority takes precedence. A priority of nullNULLUZ_PRIORITY indicates that a User Zone is for manual selection only. A mobile station will never automatically select a User Zone of priority null unless initiated manually by the user. Note that the value of User Zone Priority is non-exclusive. Note: UZ_PRIORITY is not unique; two or more UZs can have the same priority. A lower value indicates a higher priority, that is UZ_PRIORITY='0000' has a higher priority than UZ_PRIORITY='0001'. And NULL is indicated by UZ_PRIORITY = '1111'.

. RESERVED Reserved bits. The base station shall set this field to 00000.

4-52

3GPP2 C.S0016-D v2.0

2 3 4

4.5.6.4 PUZL Flags The PARAM_DATA field of the PUZL Flags Parameter Block consists of the following fields: Field UZ_LIST_ID CUR_PUZL_P_REV RESERVED UZ_TEMP_SUBSC UZ_ORIG_ONLY MANUAL_UPDATE_ALLOWED MANUAL_ACQ_ALLOWED PUZL_PRL_RELATIVE_PRIORITY PREF_ONLY UZ_DISP_IND Length (bits) 16 8 2 1 1 1 1 1 1 8

5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

UZ_LIST_ID

User Zone List Identifier The mobile station shall set this field to the value of the Preferred User Zone List Identification assigned for the preferred user zone list (PUZLs-p) by the base station.

CUR_PUZL_P_REV

Protocol revision of the mobile stations current prefered user zone list The mobile station shall set this field to the value of the PUZL_P_REV associated with its current preferred user zone list (PUZLs-p).

RESERVED UZ_TEMP_SUBSC

Reserved bits. The mobile station shall set this field to 00. User Zone Temporary Subscription flag. The base station shall set this field accordingly to indicate whether or not the mobile station is permitted to access User Zones that offer temporary subscription. If allowed, UZ_TEMP_SUBSC = 1; otherwise, UZ_TEMP_SUBSC = 0.

UZ_ORIG_ONLY

User Zone Origination Only flag.

4-53

3GPP2 C.S0016-D v2.0 The base station shall set this field accordingly to indicate whether or not the mobile station is permitted to originate calls only when within the serving area of a currently assigned User Zone. If call origination is only allowed within an assigned user zone, UZ_ORIG_ONLY = 1; otherwise, UZ_ORIG_ONLY = 0. MANUAL_UPDATE_ALLOWED - Manual update allowed flag. When set to 1 this field indicates if manual updates are allowed in this database allowing the user to add records, and modify or delete the records added by the user in the database. When set to 0 this field indicates no manual updates are allowed in this database. MANUAL_ACQ_ALLOWED - Manual acquisition allowed flag. When set to 1 this field indicates that the user is allowed to manually initiate scan and acquisition of an access point. When set to 0 this field indicates that the user is not allowed to initiate manual scan looking for available systems. PUZL_PRL_RELATIVE_PRIORITY - PUZL PRL Relative Priority flag. When set to 1 this field indicates PUZL takes precedence over PRL. When determining the sequencing of the bands/frequencies to scan applied along with the other techniques, the mobile shall provide a higher priority to the PUZL entries compared to the PRL entries. When set to 0 this field indicates PRL takes precedence over PUZL. When determining the sequencing of the bands/frequencies to scan applied along with the other techniques, the mobile shall provide a higher priority to the PRL entries compared to the PUZL entries. PREF_ONLY Preferred only flag. When set to 1 this field indicates that when the mobile station performs scans based on PUZL, the mobile station is restricted to acquire only those valid systems identified in PUZL. When set to 0 this field indicates that when the mobile station performs scans based on PUZL, it may acquire valid systems identified in PUZL and other systems not identified in PUZL. UZ_DISP_IND User Zone Display Indicator The base station shall set this field to the value of the action for displaying the default UZ indicator on the mobile stations display if this feature is supported by the MS. The value assignments are defined in [4].

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44

4-54

3GPP2 C.S0016-D v2.0 4.5.7 3GPD Parameter Blocks Table 4.5.7-1 lists the types of parameter blocks used in the 3GPD Download Request Message and the 3GPD Download Response Message.

1 2 3 4 5

Table 4.5.7-1 3GPD Parameter Block Types Parameter Block Type 3GPD Operation Mode Parameters SimpleIPSimple IP User Profile Parameters Mobile IP User Profile Parameters SimpleIPSimple IP Status Parameters MobileIPMobile IP Status Parameters SimpleIPSimple IP PAP SS Parameters1 SimpleIPSimple IP CHAP SS Parameters1 MobileIPMobile IP SS Parameters1 HRPD Access Authentication User Profile Parameters HRPD Access Authentication CHAP SS Parameters1 eHRPD MILENAGE Algorithm Parameters2 Reserved BLOCK_ID 00000000 00000001 00000010 00000110 00000111 00001000 00001001 00001010 00001011 00001100 00001101 00001110 through 11111111 Reference 4.5.7.1 4.5.7.2 4.5.7.3 4.5.7.4 4.5.7.5 4.5.7.6 4.5.7.7 4.5.7.8 4.5.7.9 4.5.7.10 4.5.7.11

The shared secret parameters shall not be transmitted over the air unencrypted.
1

The MILENAGE algorithm parameters shall not be transmitted over the air unencrypted.
2
6

4-55

3GPP2 C.S0016-D v2.0 4.5.7.1 3GPD Operation Mode Parameters The PARAM_DATA field of the 3GPD Operation Mode Parameters Block consists of the following fields: Field OP_MODE RESERVED
5 6 7 8 9 10 11 12 13 14 15 16 17

1 2 3 4

Length 2 6

OP_ MODE

The operation mode to be used by the mobile station. The base station shall set this field to the operation mode to be used by the mobile station as specified in Table 3.5.8.2-1.

RESERVED

Reserved bits. Additional reserved bits are needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set this field to 000000.

4.5.7.2 SimpleIPSimple IP User Profile Parameters The PARAM_DATA field of the SimpleIPSimple IP User Profile Parameters Block consists of the following fields:

Field NUM_NAI 4

Length (bits)

NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX NAI_LENGTH NAI AUTH_ALGORITHM 4 8 8 NAI_LENGTH 4

RESERVED
18 19 20 21 22 23

0 to 7 (as needed)

NUM_NAI

Number of SimpleIPSimple IP NAI Entries. The base station shall set this field to the number of SimpleIPSimple IP NAI entries.

The base station shall include NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX SimpleIPSimple IP NAI entry index.

4-56

3GPP2 C.S0016-D v2.0 The base station shall set this field to the index in the SimpleIPSimple IP NAI Table. NAI_LENGTH SimpleIPSimple IP NAI length. The base station shall set this field to the length of the NAI in units of octet. NAI Network Access Identifier. The base station shall set this field to the Network Access Identifier (NAI), encoded in ASCII string, refer to [14]. The NAI is of the form user@realm. AUTH_ALGORITHM Authentication Algorithm for SimpleIPSimple IP. The base station shall set this field to the authentication algorithm used to calculate the Simple IP Authentication. The Authentication Algorithm is specified in Table 3.5.8.5-1. RESERVED Reserved bits. The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

4-57

3GPP2 C.S0016-D v2.0 4.5.7.3 Mobile IP User Profile Parameters The PARAM_DATA field of the Mobile IP User Profile Parameters Block consists of the following fields: Field RETRY_INFO_INCLUDED MAX_NUM_RETRY FIRST_RETRY_TIMEOUT REREG_THRESHOLD NUM_NAI 1 0 or 2 0 or 3 0 or 6 4 Length (bits)

1 2 3 4

NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX NAI_LENGTH NAI T_BIT HOME_ADDRESS PRIMARY_HOME_AGENT SECONDARY_HOME_AGENT MN-AAA_AUTH_ALGORITHM MN-AAA-SPI_INDICATOR MN-AAA_SPI MN-HA_AUTH_ALGORITHM MN-HA_SPI_INDICATOR MN-HA_SPI 4 8 8 NAI_LENGTH 1 32 32 32 4 1 0 or 32 4 1 0 or 32

RESERVED
5 6 7 8 9 10 11 12 13 14 15

0 to 7 (as needed)

RETRY_INFO_INCLUDED -

Indicate if the retry information is included or not. If MAX_NUM_RETRY, FIRST_RETRY_TIMEOUT and REREG_THRESHOLD are included in this block, the base station shall set this field to 1; otherwise, the base station shall set this field to 0.

MAX_NUM_RETRY

Maximum Number of Retry for the MobileIPMobile IP Registration. If RETRY_INFO_INCLUDED is set to 0, the base station shall omit this field; otherwise, the base station shall set this field as follows:

4-58

3GPP2 C.S0016-D v2.0 The base station shall set this field to the maximum number of retries for MobileIPMobile IP registration. FIRST_RETRY_TIMEOUT The amount of time elapsed between the first and second MobileIPMobile IP Registration Requests, while the mobile station did not receive the MobileIPMobile IP Registration Reply. If RETRY_INFO_INCLUDED is set to 0, the base station shall omit this field; otherwise, the base station shall set this field as follows: The base station shall set this field to one less than the number of amount of time elapsed, in units of 250ms, between the first and second MobileIPMobile IP Registration Requests, while the mobile station did not receive the MobileIPMobile IP Registration Reply. REREG_THRESHOLD Re-Registration Threshold. If RETRY_INFO_INCLUDED is set to 0, the base station shall omit this field; otherwise, the base station shall set this field as follows: The base station shall set this field to the time, in units of minute, before the expiration of the registration lifetime that the mobile will try to reregister. NUM_NAI Number of MobileIPMobile IP NAI Entries. The base station shall set this field to the number of MobileIPMobile IP NAI entries. The base station shall include NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX MobileIPMobile IP NAI entry index. The base station shall set this field to the index in the MobileIPMobile IP NAI Table. NAI_LENGTH MobileIPMobile IP NAI length. The base station shall set this field to the length of the MobileIPMobile IP NAI, in units of octet. NAI Network Access Identifier. The base station shall set this field to the Network Access Identifier (NAI), encoded in ASCII string, refer to [14]. The NAI is of the form user@realm. T_BIT Reverse Tunneling. The base station shall set this field to 1 to request reverse tunneling or set this field to 0 if reverse tunneling is not required, see [13]. HOME_ADDRESS Home Address. The base station shall set this field to the IP address of the mobile node in the form of network byte code. PRIMARY_HOME_AGENT Primary Home Agent.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43

4-59

3GPP2 C.S0016-D v2.0 The base station shall set this field to the IP address of the mobile node's primary home agent in the form of network byte code. SECONDARY_HOME_AGENT - Secondary Home Agent. The base station shall set this field to the IP address of the mobile node's back-up/secondary home agent in the form of network byte code. MN-AAA_AUTH_ALGORITHM - Authentication Algorithm (MN-AAA) The base station shall set this field to the authentication algorithm used to calculate the Mobile IP MN-AAA Authentication Extension as defined in [15]. The Authentication Algorithm is specified in Table 3.5.8.6-1. MN-AAA_SPI_INDICATOR Indicator of SPI between MN and AAA. The base station shall set this field to 1 if the Security Parameter Index is included; otherwise, the base station shall set this field to 0. MN-AAA_SPI SPI between MN and AAA. If the MN-AAA_ SPI_INDICATOR field is set to 1, the base station shall set this field to the Security Parameter Index (MN-AAA); otherwise, the base station shall omit this field. MN-HA_AUTH_ALGORITHM - Authentication Algorithm (MN-HA) The base station shall set this field to the authentication algorithm used to calculate the Mobile IP MN-HA Authentication Extension as defined in [12]. The Authentication Algorithm is encoded according to Table 3.5.8.6-1. MN-HA_SPI_INDICATOR Indicator of SPI between MN and HA. The base station shall set this field to 1 if Security Parameter Index is included; otherwise, the base station shall set this field to 0. MN-HA_SPI SPI between MN and HA. If the MN-HA_SPI_INDICATOR field is set to 1, the base station shall set this field to the Security Parameter Index between MN and HA; otherwise, The base station shall omit this field. RESERVED Reserved bits. The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43

4-60

3GPP2 C.S0016-D v2.0 4.5.7.4 SimpleIPSimple IP Status Parameters Field ACT_NAI_ENTRY_INDEX RESERVED
3 4 5 6 7

1 2

Length (bits) 4 4

ACT_NAI_ENTRY_INDEX -

The SimpleIPSimple IP NAI entry index to be used by the mobile station. The base station shall set this field to the SimpleIPSimple IP NAI entry index to be used by the mobile station.

8 9 10 11 12

RESERVED

Reserved bits. Additional reserved bits are needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set this field to 0000.

13 14

4.5.7.5 MobileIPMobile IP Status Parameters Field ACT_NAI_ENTRY_INDEX NUM_ADD_ACT_NAI 4 4 Length (bits)

NUM_ADD_ACT_NAI occurrences of the following field: ADD_ACT_NAI_ENTRY_INDEX 4

RESERVED
15 16 17 18 19 20

0 or 4 (as needed)

ACT_NAI_ENTRY_INDEX -

The MobileIPMobile IP NAI entry index to be used by the mobile station. The base station shall set this field to the MobileIPMobile IP NAI entry index to be used by the mobile station in the 3GPD Download Request Message.

21 22 23

NUM_ADD_ACT_NAI

Number of additional Active MobileIPMobile IP NAI entries. The base station shall set this field to the number of additional active MobileIPMobile IP NAI entries.

24 25

ADD_ACT_NAI_ENTRY_INDEX index.

Additonal Active MobileIPMobile IP NAI entry

4-61

3GPP2 C.S0016-D v2.0 The base station shall set this MobileIPMobile IP NAI entry index. RESERVED Reserved bits. The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0. field to the active

1 2

3 4 5 6 7 8

9 10

4.5.7.6 SimpleIPSimple IP PAP SS Parameters

Field NUM_NAI 4

Length (bits)

NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX SS_LENGTH SS 4 5 8 SS_LENGTH

RESERVED
11

0 to 7 (as needed)

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

NUM_NAI

Number of SimpleIPSimple IP NAI Entries. The base station shall set this field to the number of SimpleIPSimple IP NAI entries.

The base station shall include NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX SimpleIPSimple IP NAI entry index. The base station shall set this field to the index in the SimpleIPSimple IP NAI Table. SS_LENGTH Shared Secret Data Length. The base station shall set this field to the length, in units of octet, of the shared secret data. SS RESERVED Shared Secret Data. The base station shall set this field to the Shared Secret Data. Reserved bits. The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

4-62

3GPP2 C.S0016-D v2.0 4.5.7.7 SimpleIPSimple IP CHAP SS Parameters

Field NUM_NAI 4

Length (bits)

NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX SS_LENGTH SS 4 5 8 SS_LENGTH

RESERVED
3

0 to 7 (as needed)

4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

NUM_NAI

Number of SimpleIPSimple IP NAI Entries. The base station shall set this field to the number of SimpleIPSimple IP NAI entries.

The base station shall include NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX SimpleIPSimple IP NAI entry index. The base station shall set this field to the index in the SimpleIPSimple IP NAI Table. SS_LENGTH Shared Secret Data Length. The base station shall set this field to the length, in units of octet, of the shared secret data. SS RESERVED Shared Secret Data The base station shall set this field to the Shared Secret Data. Reserved bits. The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

4-63

3GPP2 C.S0016-D v2.0

1 2

4.5.7.8 MobileIPMobile IP SS Parameters

Field NUM_NAI 4

Length (bits)

NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX MN-AAA_SS_LENGTH MN-AAA_SS MN-HA_SS_LENGTH MN-HA_SS 4 5 8 MN-AAA_SS_LENGTH 5 8 MN-FA_SS_LENGTH

RESERVED
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

0 to 7 (as needed)

NUM_NAI

Number of MobileIPMobile IP NAI Entries. The base station shall set this field to the number of MobileIPMobile IP NAI entries.

The base station shall include NUM_NAI occurrences of the following fields: NAI_ENTRY_INDEX MobileIPMobile IP NAI entry index. The base station shall set this field to the index in the MobileIPMobile IP NAI Table. MN-AAA_SS_LENGTH Shared Secret Data Length between MN and AAA. The base station shall set this field to the length, in units of octet, of the shared secret data between MN and AAA. MN-AAA_SS Shared Secret Data between MN and AAA. The base station shall set this field to the Shared Secret Data between MN and AAA. MN-HA_SS_LENGTH Shared Secret Data Length between MN and HA. The base station shall set this field to the length, in units of octet, of the shared secret data. MN-HA_SS Shared Secret Data between MN and HA. The base station shall set this field to the Shared Secret Data between MN and HA. RESERVED Reserved bits. The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

4-64

3GPP2 C.S0016-D v2.0

1 2 3 4

4.5.7.9 HRPD Access Authentication User Profile Parameters The PARAM_DATA field of the HRPD Access Authentication User Profile Parameters Block consists of the following fields:

Field NAI_LENGTH NAI AUTH_ALGORITHM RESERVED

5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

Length (bits) 8 8 NAI_LENGTH 4 4

NAI_LENGTH

NAI length. The mobile station shall set this field to the length of the NAI in units of octet.

NAI

Network Access Identifier. The mobile station shall set this field to the Network Access Identifier (NAI), encoded in ASCII string, refer to [14]. The NAI is of the form user@realm.

AUTH_ALGORITHM

Authentication Algorithm for HRPD Access Authentication. The mobile station shall set this field to the authentication algorithm used to calculate the HRPD Access Authentication. The Authentication Algorithm is specified in Table 3.5.8.13-1.

RESERVED

Reserved bits. The mobile station shall set this field to 0000.

20 21

4.5.7.10 HRPD Access Authentication CHAP SS Parameters Field SS_LENGTH SS RESERVED 5 8 SS_LENGTH 3 Length (bits)

22

23 24 25 26 27

SS_LENGTH

Shared Secret Data Length. The mobile station shall set this field to the length, in units of octet, of the shared secret data. The mobile station shall support the shared secret data of at least 16 octets long.

SS

Shared Secret Data

4-65

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the Shared Secret Data. RESERVED Reserved bits. Additional reserved bits are needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 000.

1 2 3 4 5 6 7 8

9 10 11 12

4.5.7.11 eHRPD MILENAGE Algorithm Parameters The PARAM_DATA field of the eHRPD MILENAGE Algorithm Parameters Block consists of the following fields: Field OP_PARAM_VALUE OP_PARAM_TYPE RESERVED 128 1 7 Length (bits)

13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

OP_PARAM_VALUE OP_PARAM_TYPE

128-bit MILENAGE Operator Variant Algorithm Configuration Field (refer to [TS 35.205]). The base station shall set this bit to 0, if the OP_PARAM_VALUE is to be interpreted by the mobile station as the OP parameter defined in [29]; otherwise, the base sation shall set this bit to 1 to indicate to the mobile station that the OP_PARAM_VALUE is to be interpreted as the OPc parameter defined in [29]. Reserved bits. Additional reserved bits are needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0000000.

RESERVED

4-66

3GPP2 C.S0016-D v2.0 4.5.8 MMD Parameter Block Table 4.5.8-1 lists the types of parameter blocks used in the MMD Download Request Message and the MMD Download Response Message. Table 4.5.8-1 MMD Parameter Block Types Parameter Block Type MMD Application Parameters Reserved BLOCK_ID 00000000 00000001 through 11111111 Reference 4.5.8.1

1 2 3 4

5 6 7

4.5.8.1 MMD Application Parameters The PARAM_DATA field of the MMD Application Parameters Block consists of the following fields: Field IMPI_LENGTH IMPI NUM_IMPU 8 8 IMPI_LENGTH 4 Length (bits)

NUM_IMPU occurrences of the following fields: IMPU_ENTRY_IDX IMPU_LENGTH IMPU 4 8 8 IMPU_LENGTH

SIP_URI_LENGTH SIP_DOMAIN_URI NUM_P-CSCF

8 8 SIP_URI_LENGTH 4

NUM_P-CSCF occurrences of the following fields: P-CSCF_ENTRY_IDX P-CSCF_LENGTH P-CSCF_ADDRESS 4 8 8 P-CSCF_LENGTH

RESERVED
8 9 10 11

0 to 7

IMPI_LENGTH

IMS Private Identity length The mobile station shall set this field to the length of the IMPI in units of octets

IMPI

IMS Private Identity.

4-67

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to the IMS Private Identity, encoded in ASCII string, refer to [17]. NUM_IMPU Number of IMS Public Identity entries. The mobile station shall set this field to the number of IMS Public Identity entries. The mobile station shall include NUM_IMPU occurrences of the following fields: IMPU_ENTRY_IDX IMPU entry index. The mobile station shall set this field to the index in the IMPU Table. IMPU_LENGTH IMS Public Identity length. The mobile station shall set this field to the length of the IMPU in units of octet. IMPU IMS Public Identity. The mobile station shall set this field to the IMS Public Identity (IMPU), encoded in ASCII string, refer to [17]. SIP_URI_LENGTH SIP Domain URI length. The mobile station shall set this field to the length of the SIP Domain URI. SIP_DOMAIN_URI SIP Domain URI. The mobile station shall set this field to the SIP Domain URI, encoded in ASCII string, refer to [17]. NUM_P-CSCF Number of P-CSCF entries The mobile station shall set this field to the number of PCSCF entries. The mobile station shall include NUM_P-CSCF occurrences of the following fields: P-CSCF_ENTRY_IDX P-CSCF entry index. The mobile station shall set this field to the index in the PCSCF Table. P-CSCF_LENGTH P-CSCF length. The mobile station shall set this field to the length of the PCSCF in units of octet. P-CSCF_ADDRESS P-CSCF address. The mobile station shall set this field to the P-CSCF address, encoded in ASCII string, refer to [17] RESERVED Reserved bits. The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

4-68

3GPP2 C.S0016-D v2.0 4.5.9 System Tag Parameter Blocks Table 4.5.9-1 lists the types of parameter blocks used in the System Tag Download Request Message and the System Tag Download Response Message.

1 2 3 4 5

Table 4.5.9-1

System Tag Parameter Block Types BLOCK_ID 00000000 00000001 00000010 00000011 00000100 - 01111110011111 11 01111111 1000000011111110 11111111 Reference 4.5.9.1 4.5.9.2 4.5.9.3 4.5.9.4 4.5.9.4

System Tag Parameter Block Type Home System Tag Group Tag List Specific Tag List Call Prompt List Reserved for future standardization

NULLSYS_TAG_BLOCK_ID Available for manufacturer-specific parameter block definitions Reserved

6

1.2.3 See [4]

7 8 9

4.5.9.1 Home System Tag Parameter Block The PARAM_DATA field of the Home System Tag Parameter Block consists of the following fields: Field RESERVED TAG_ENCODING TAG_LEN TAG 6 5 5 TAG_LEN 8 Length (bits)

10 11 12 13 14 15 16 17 18

RESERVED TAG_ENCODING

Reserved bits. The base station shall set this field to 000000. Tag encoding. See [4]. This field shall be set to indicate the character set used in the TAG field included in this parameter block.

TAG_LEN

Tag length. The mobile station shall set this field to the number of octets in the TAG field.

TAG

Tag characters.

4-69

3GPP2 C.S0016-D v2.0 The mobile station shall set this field to characters based on the encoding method defined in TAG_ENCODING.

1 2 3

4-70

3GPP2 C.S0016-D v2.0

1 2 3

4.5.9.2 Group Tag List Parameter Block The PARAM_DATA field of the Group Tag List Parameter Block consists of the following fields: Field CUR_TAG_P_REV RESERVED LAST_SEGMENT SEGMENT_OFFSET SEGMENT_SIZE SEGMENT_DATA 8 7 1 16 8 SEGMENT_SIZE 8 Length (bits)

4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

CUR_TAG_P_REV

Protocol revision for the system tag. This field is used to specify the format of the rest of the System Tag.

RESERVED LAST SEGMENT

Reserved bits. The base station shall set this field to 0000000. Last segment indicator bit. The basemobile station shall set this field to 1 if SEGMENT_DATA contains the last octet of the group tag list (GROUP_TAG_LISTs-p); otherwise, the basemobile station shall set this field to 0.

SEGMENT_OFFSET

Segment offset. The base station shall set this field to the starting offset, within the group tag list (GROUP_TAG_LISTS-P) at which the mobile station is to store the octets included in SEGMENT_DATA.The mobile station shall set this field to the value of REQUEST_OFFSET from the corresponding System Tag Configuration Request Message.

SEGMENT_SIZE

Segment size. The basemobile station shall set this field to the number of octets of the group tag list (GROUP_TAG_LISTs-p) included in SEGMENT_DATA.

SEGMENT_DATA

Segment of the group tag list (GROUP_TAG_LISTs-p) data. If REQUEST_OFFSET from the corresponding System Tag Configuration Request Message specifies an offset that is invalid for the current group tag list, the mobile station shall include no octets in this field.

4-71

3GPP2 C.S0016-D v2.0 If REQUEST_OFFSET specifies an offset that is valid for the current group tag list, the mobile station shall include at most REQUEST_MAX_SIZE sequential octets of the group tag list in this field.This field contains SEGMENT_SIZE The octets shall be equal to the octets starting at the offset specified by SEGMENT_OFFSET within the group tag list (GROUP_TAG_LISTS-P) specified by SEGMENT_OFFSET.

1 2 3 4 5 6 7 8

4-72

3GPP2 C.S0016-D v2.0

1 2 3

4.5.9.3 Specific Tag List Parameter Block The PARAM_DATA field of the Specific Tag List Parameter Block consists of the following fields: Field CUR_TAG_P_REV RESERVED LAST_SEGMENT SEGMENT_OFFSET SEGMENT_SIZE SEGMENT_DATA 8 7 1 16 8 SEGMENT_SIZE 8 Length (bits)

4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

CUR_TAG_P_REV

Protocol revision for the system tag. This field is used to specify the format of the rest of the System Tag.

RESERVED LAST SEGMENT

Reserved bits. The base station shall set this field to 0000000. Last segment indicator bit. The basemobile station shall set this field to 1 if SEGMENT_DATA contains the last octet of the specific tag list (SPEC_TAG_LISTs-p); otherwise, the basemobile station shall set this field to 0.

SEGMENT_OFFSET

Segment offset. The base station shall set this field to the starting offset, within the specific tag list (SPEC_TAG_LISTS-P) at which the mobile station is to store the octets included in SEGMENT_DATA.The mobile station shall set this field to the value of REQUEST_OFFSET from the corresponding System Tag Configuration Request Message.

SEGMENT_SIZE

Segment size. The basemobile station shall set this field to the number of octets of the specific tag list (SPEC_TAG_LISTs-p) included in SEGMENT_DATA.

SEGMENT_DATA

Segment of the specific tag list (SPEC_TAG_LISTs-p) data. This field contains SEGMENT_SIZE octets starting at the offset specified by SEGMENT_OFFSET within the specific tag list (SPEC_TAG_LISTS-P).If REQUEST_OFFSET from the corresponding System Tag Configuration Request Message specifies an offset that is invalid for the current specific tag list, the mobile station shall include no octets in this field.

4-73

3GPP2 C.S0016-D v2.0 If REQUEST_OFFSET specifies an offset that is valid for the current specific tag list, the mobile station shall include at most REQUEST_MAX_SIZE sequential octets of the specific tag list in this field. The octets shall be equal to the octets starting at the offset within the specific tag list specified by SEGMENT_OFFSET.

1 2 3 4 5 6

7 8 9

4.5.9.4 Call Prompt List Parameter Block The PARAM_DATA field of the Call Prompt List Parameter Block consists of the following fields: Field CUR_TAG_P_REV RESERVED LAST_SEGMENT SEGMENT_OFFSET SEGMENT_SIZE SEGMENT_DATA 8 7 1 16 8 SEGMENT_SIZE 8 Length (bits)

10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

CUR_TAG_P_REV

Protocol revision for the system tag. This field is used to specify the format of the rest of the System Tag.

RESERVED LAST SEGMENT

Reserved bits. The base station shall set this field to 0000000. Last segment indicator bit. The basemobile station shall set this field to 1 if SEGMENT_DATA contains the last octet of the call prompt list (CALL_PRMPT_LISTs-p); otherwise, the basemobile station shall set this field to 0.

SEGMENT_OFFSET

Segment offset. The base station shall set this field to the starting offset, within the call prompt list (CALL_PRMPT_LISTS-P) at which the mobile station is to store the octets included in SEGMENT_DATA.The mobile station shall set this field to the value of REQUEST_OFFSET from the corresponding System Tag Configuration Request Message.

SEGMENT_SIZE

Segment size. The basemobile station shall set this field to the number of octets of the call prompt list (CALL_PRMPT_LISTs-p) included in SEGMENT_DATA.

SEGMENT_DATA

Segment of the call prompt list (CALL_PRMPT_LISTs-p) data.

4-74

3GPP2 C.S0016-D v2.0 This field contains SEGMENT_SIZE octets starting at the offset specified by SEGMENT_OFFSET within the call prompt list (CALL_PRMPT_LISTS-P).If REQUEST_OFFSET from the corresponding System Tag Configuration Request Message specifies an offset that is invalid for the current call prompt list, the mobile station shall include no octets in this field. If REQUEST_OFFSET specifies an offset that is valid for the current call prompt list, the mobile station shall include at most REQUEST_MAX_SIZE sequential octets of the call prompt list in this field. The octets shall be equal to the octets starting at the offset within the call prompt list specified by SEGMENT_OFFSET.

1 2 3 4 5 6 7 8 9 10 11 12

13 14 15 16 17

4.5.10 MMS Parameter Block Table 4.5.10-1 lists the types of parameter blocks used in the MMS Download Request Message and the MMS Download Response Message.

Table 4.5.10-1 MMS Parameter Block Types Parameter Block Type MMS URI Parameters Reserved BLOCK_ID 00000000 00000001 through 11111111 Reference 4.5.10.1

18 19 20

4.5.10.1 MMS URI Parameters The PARAM_DATA field of the MMS Application URI Block consists of the following fields: Field NUM_MMS_URI 4 Length (bits)

NUM_MMS_URI occurrences of the following fields: MMS_URI_ENTRY_IDX 4 MMS_URI_LENGTH MMS URI 8 8 x MMS_URI_LENGTH

RESERVED
21 22 23 24 25

0 to 7

NUM_MMS_URI

Number of MMS URIs The base station shall set this field to the number of MMS URIs stored on the mobile, encoded in ASCII string, refer to [16], [17] and [18].

The mobile station shall include NUM_MMS_URI occurrences of the following fields:

4-75

3GPP2 C.S0016-D v2.0 MMS_URI_ENTRY_IDX MMS URI entry index. The base station shall set this field to the index in the MMS URI Table, refer to [16], [17]and [18]. MMS_URI_LENGTH MMS URI length. The base station shall set this field to the length of the URI associated with the MMS Relay/Server in units of octet MMS_URI MMS_URI The base station shall set this field to the URI of the MMS Relay/Server, encoded in ASCII string, refer to [16], [17] and [18]. RESERVED Reserved bits. The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

16

17 18 19 20 21

4.5.11 MMSS Parameter Blocks Table 4.5.11-1 lists the types of parameter blocks used in the MMSS Download Request Message and the MMSS Download Response Message.

Table 4.5.11-1 MMSS Download Parameter Block Types Parameter Block Type MMSS MODE SETTINGS BLOCK_ID 00000000 Reference 4.5.11.1 4.5.11.2 4.5.11.3 4.5.11.4

MMSS Location Associated Priority List 00000001 (MLPL) MMSS System Priority List (MSPL) MMSS WLAN DOWNLOAD PARAM Reserved for future access technologies 00000010 00000011 00000100 through 01111111

Available for manufacturer-specific 10000000 parameter block definitions through 11111110 Reserved
22

See [4]

11111111

4-76

3GPP2 C.S0016-D v2.0 4.5.11.1 MMSS Mode Settings Parameter Block The MMSS Mode Settings is applicable to cdma2000 and non-cdma2000 cellular systems. The MMSS Mode Settings is associated with MMSS System Priority List. The PARAM_DATA field of the MMSS Mode Settings consists of the following fields: Field MMSS_MODE
6 7 8 9 10

1 2 3 4 5

Length (bits) 8

MMSS_MODE

MMSS Mode. The base station assigns the value for each mode as defined in the Table in Sec. 3.5.13.2.

11 12 13 14 15 16

4.5.11.2 MMSS Location Associated Priority List (MLPL) Parameter Block The MLPL and its stored version MLP_LISTS-P is a list of groupings based on location specific information. MLPL allows the base station to specify the MSPL to be used in a location area. Various ways of defining location is specified by the Location Type. Each entry in the list points to an MSPL (see section 4.5.11.3).

Field MLPL_SIZE CUR_MMSS_P_REV MLPL_VER_ID MLPL_ID NUM_MLPL_RECS

17

Length (bits) 16 8 16 8 8

NUM_MLPL_RECS occurrences of the following: LOC_PARAM_TYPE LOC_PARAM_VAL MSPL_INDEX RESERVED MLPL_CRC 8 Variable 8 0 to 7 16

18 19 20 21

MLPL_SIZE

Location associated priority list size. This field is set to the total size, in octets, of the MLPL, including the MLPL_SIZE and MLPL_CRC fields.

4-77

3GPP2 C.S0016-D v2.0 CUR_MMSS_P_REV Protocol Revision of the current MMSS_P_REV The base station shall set this field to the value of the MMSS_P_REV associated with this MLPL. MLPL_VER_ID MLPL Version Identification The base station assigns the value of the MLPL Version Identification assigned for the MLPL (MLP_LISTs-p). MLPL_ID MMSS Location Priority List identification. Unique identification for the MLPL assigned by the base station. NUM_MLPL_RECS LOC_PARAM_TYPE Number of MMSS system priority records. This field is set to the number of entries in the MLPL. Location Parameter Type This field identifies the parameter used for Location grouping. Possible parameters are described in Table 3.5.13.3-1. The location parameter type can be specified as any combinations of MCC, MNC and NUM_SYS_LOC_TAG. The NUM_SYS_LOC_TAG bit specifies the location grouping to which this MLPL record belongs. When bits 0, 1, and 2 are all set to 0 the Default type shall be used. The Default type represents the case when no location information is available to the device. LOC_PARAM_VAL Location Parameter Value LOC_PARAM_VAL is the value of the Location Parameter used. This field is variable in length, depending on the LOC_PARAM_TYPE used for location grouping. The length of LOC_PARAM_VAL for each LOC_PARAM_TYPE is described in Table 3.5.13.3-2. MSPL_INDEX MMSS System Priority List Index This field is set to the MSPL_ID of the MMSS System Priority List corresponding to an MLPL entry. RESERVED Reserved bits. The mobile station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to 0. MLPL_CRC CRC for MLPL This field is set to the 16-bit CRC calculated according to 3.5.14.1.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38

39 40 41 42

4.5.11.3 MMSS System Priority List (MSPL) Parameter Block The MSPL is a prioritized list of cdma2000 and non-cdma2000 cellular systems. The MSPL assists a multimode mobile station in selecting a system. Once a system is selected, the mobile station follows standard network selection procedures for the selected system to

4-78

3GPP2 C.S0016-D v2.0 acquire a network. The MMSS System Priority list can be sent to the mobile station using Over-the-Air Service Provisioning (OTASP). The MMSS System Priority list is retained by the mobile station when power is turned off. There shall be only one MSPL associated with a location grouping in the MLPL. The MMSS System Priority List consists of the following fields: The MSP_LISTS-P, which stores the MSPL, consists of the following fields:

1 2 3 4 5 6 7 8

Field MSPL_SIZE CUR_MMSS_P_REV MSPL_VER_ID NUM_MSPL_ID

Length (bits) 16 8 16 8

NUM_MSPL_ID occurrences of the following fields: { (NUM_MSPL_ID) MSPL_ID NUM_MSPL_RECS

9 10

8 8

NUM_MSPL_RECS occurrences of the following six fields: { (NUM_MSPL_RECS) SYS_TYPE PRI_CLASS SYS_PRI HIGHER_PRI_SRCH_TIME NETWORK_CAP_IND NETWORK_CAP } (NUM_MSPL_RECS) } (NUM_MSPL_ID) RESERVED MSPL_CRC 0 to 7 16 8 4 1 3 1 6 or 0

11 12 13 14 15

MSPL_SIZE

MMSS System Priority List size. This field is set to the total size, in octets, of the MMSS system priority list, including the MSPL_SIZE and MSPL_CRC fields.

4-79

3GPP2 C.S0016-D v2.0 CUR_MMSS_P_REV Protocol Revision of the current MMSS_P_REV The base station shall set this field to the value of the MMSS_P_REV associated with this MSPL. MSPL_VER_ID MSPL Version Identification The base station assigns the value of the MSPL Version Identification assigned for the MSPL (MSP_LISTs-p). NUM_MSPL_ID Number of MSPL IDs This field is set to the number of MSPL_IDs in this set of MSPL_IDs. MSPL_ID MMSS system priority list identification. The base station shall set this field to the value of the MMSS System Priority List Identification assigned for the MMSS System Priority List. NUM_MSPL_RECS Number of MMSS system priority records. This field is set to the number of MMSS system priority records contained in the MSPL block. SYS_TYPE PRI_CLASS System Type identification. The system type shall be set according to Table 3.5.13.4-1. Priority Class. Priority Class defines the selection priority to be used in a system as allowed in that system. PRI_CLASS shall be one of the following. 0000 - Home only The MS can select only home operator network in the system. 0001 - Home + Preferred. The MS can select home operator network and preferred operator network in the system. 0010 to 1110 Reserved. 1111 - Any. The MS can select any operator network in the system. SYS_PRI System Priority. This field indicates the relative priority of systems in the MMSS system priority table. The relative priority can be more (1) or same (0). The last entry in the MMSS system priority table has the system priority set to 0. For each entry a 1 indicates that the current system type is of higher priority than the next system type in the table. For each entry a 0 indicates that the current system type is of same priority as the next system type in the table. HIGHER_PRI_SRCH_TIME - Higher Priority Search Time.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

4-80

3GPP2 C.S0016-D v2.0 Set to the time between searches of higher priority systems of other radio access technologies that the mobile station may use when this entry is the current system. This field shall be set to the value from Table 3.5.13.4-2 corresponding to the desired search time. NETWORK_CAP_IND NETWORK_CAP RESERVED If a NETWORK_CAP is to be included in this MSPL record this field shall be set to 1. Otherwise this field shall be set to 0. If the NETWORK_CAP_IND is set to 1, this field shall be set to a value from Table 3.5.13.4-3. Otherwise, it is omitted. Reserved bits. The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. Each reserved bit shall be set to '0'. MSPL_CRC CRC for MSPL This field is set to the 16-bit CRC calculated according to 3.5.14.1.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

18 19

4.5.11.4 MMSS WLAN Download PARAM Type-specific Record WLAN_AIR_INT_ALLOWED NUM_WLAN_SERV_CAT 1 7 Length (bits)

NUM_WLAN_SERV_CAT occurrences of the following fields: WLAN_SERV_CAT_TYPE AUTO_ACQ_ALLOWED MANUAL_ACQ_ALLOWED SIMULTANEOUS_ALLOWED WLAN_SCAN_MODE WLAN_SCAN_LIMIT EMG_CALL_ALLOWED VOIP_SERVICES_ALLOWED POS_DET_ALLOWED NUM_WLAN_AIR_INT
20

8 1 1 1 1 3 1 1 1 8

NUM_WLAN_AIR_INT occurrences of the following field: WLAN_AIR_INT_TYPE 8

21

4-81

3GPP2 C.S0016-D v2.0

RESERVED
1 2 3 4 5 6 7 8 9

0 to 7

WLAN_AIR_INT_ALLOWED - The network shall set this field to 1 if WLAN is allowed. Otherwise, this field shall be set to 0. NUM_WLAN_SERV_CAT If WLAN_AIR_INT_ALLOWED is set to 1, set NUM_WLAN_SERV_CAT to the number of WLAN service categories supported. Otherwise this field shall be set to 0. This field is set according to Table 4.5.11.4-1 for the type of service category for this record. Value 00000000 00000001 00000010 00000011 00000100 00000101 11111111

WLAN_SERV_CAT_TYPE -

Table 4.5.11.4-1 WLAN Service Category Types WLAN_SERV_CAT_TYPE Operator Designated Aggregator Enterprise User Defined ANY Reserved

10 11 12 13 14 15 16 17 18 19 20 21 22

AUTO_ACQ_ALLOWED

This field shall be set to 1 if WLAN can be acquired automatically. Otherwise this field shall be set to 0.

MANUAL_ACQ_ALLOWED - This field shall be set to 1 if the mobile station is allowed to enable WLAN manually. Otherwise this field shall be set to 0. SIMULTANEOUS_ALLOWED - This field shall be set to 1 if the mobile station is allowed to operate both WLAN radio when accessing or connected to WLAN_SERV_CAT_TYPE of User Defined and cellular systems at the same time. Otherwise this field shall be set to 0. WLAN_SCAN_MODE If active scan is allowed, set this field to 1. Otherwise, set this field to 0.

4-82

3GPP2 C.S0016-D v2.0 WLAN_SCAN_LIMIT WLAN scanning duration is set by defining scan values given in Table 4.5.11.4-1. The WLAN_SCAN_LIMIT is used by a timer to allow the carrier to specify the maximum duration in minutes that the mobile station is permitted to search for WLAN based on time while the mobile station is in the idle mode. If the mobile station has not acquired and selected a WLAN system prior to the expiration of the timer, the mobile station shall stop performing time-based searches for WLAN systems. If another parameter causes the mobile station to search for WLAN prior to the expiration of the timer, the timer shall not be reset. If the duration of this parameter is reached, the timer shall be reset when another parameter causes the mobile station to search for WLAN. The specified parameter does not require a continuous search for WLAN. This is a time-based parameter for WLAN searches. Other parameters (e.g. manual override, launch of an application, change in location) that are not time-based can override this time-based parameter. Table 4.5.11.4-1 WLAN Scan Limit WLAN_SCAN_LIMIT 000 001 010 011 100 101 110 111
20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

Description No Defined Limit Maximum 2 minutes Maximum 4 minutes Maximum 8 minutes Maximum 16 minutes Maximum 32 minutes Maximum 64 minutes Reserved

EMG_CALL_ALLOWED

If emergency call is allowed, set this field to 1. Otherwise, set this field to 0.

VOIP_SERVICES_ALLOWED - If VoIP services is allowed, set this field to 1. Otherwise, set this field to 0. POS_DET_ALLOWED NUM_WLAN_AIR_INT If position determination is allowed, set this field to 1. Otherwise, set this field to 0. This field shall be set to the number of WLAN air interfaces supported for this record. Otherwise this field shall be set to 0. WLAN_Air Interface Types. The base station shall set this field according to Table 3.5.13.5-1 to indicate the supported types of WLAN Air Interface Radio. RESERVED Reserved bits.

WLAN_AIR_INT_TYPE

4-83

3GPP2 C.S0016-D v2.0 The base station shall add reserved bits as needed in order to make the length of the entire parameter block equal to an integer number of octets. The base station shall set these bits to 0.

1 2 3 4 5 6

4-84

3GPP2 C.S0016-D v2.0

KEY EXCHANGE PROCEDURES

5.1 Mobile Station Requirements for A_KEY_P_REV < 00000011 5.1.1 Random Number Generation The mobile station shall generate a random number X for use in calculating the mobile station result, MS_RESULT. The number X shall have the following properties: The number generated shall be 160-bits in length. The number generated shall not be less than 4. The number generated shall have an uniform statistical distribution over its range. The numbers used in formulating different Key Generation Response Messages sent by the same mobile station shall be statistically uncorrelated. The number used in formulating each Key Generation Response Message shall not be derivable from the previously used numbers or mobile station indicator values. The numbers used in formulating Key Generation Response Messages sent by different mobile stations shall be statistically uncorrelated.

3 4 5 6 7 8 9 10 11 12 13 14 15

16

5.1.2 Mobile Station Result The mobile station shall calculate MS_RESULT = PARAM_GsX modulo PARAM_Ps.

17

18

19

5.1.3 A-key Computation The mobile station shall compute the common key K = BS_RESULTsX modulo PARAM_Ps. The mobile station shall store the least significant 64 bits of the result K as A_KEY_TEMPs. 5.2 Base Station Requirements for A_KEY_P_REV < 00000011 5.2.1 Generation of the Key Exchange Parameters The base station shall select and store a 512-bit prime number P based on the following criteria: P should be chosen randomly. (P - 1) should have a large prime factor. The most significant bit of P should be equal to 1. The base station shall set PARAM_P of the MS Key Request Message to P. The base station shall select a 160-bit number G such that it is greater than 1 and less than (P-1). The base station shall set PARAM_G of the MS Key Request Message to G.

20 21

22

23 24 25 26 27 28 29 30 31

5-85

3GPP2 C.S0016-D v2.0 The base station shall generate a random number Y for use in calculating the base station result, BS_RESULT. The number Y shall have the following properties: The number generated shall be 160-bits in length. The number generated shall not be less than 4. The number generated shall have an uniform statistical distribution over its range. The numbers used in formulating different Key Generation Request Messages sent by the same base station shall be statistically uncorrelated. The numbers used in formulating Key Generation Request Message sent by different base stations shall be statistically uncorrelated.

1 2 3 4 5 6 7 8 9 10

11

5.2.2 Base Station Result The base station shall calculate BS_RESULT = PARAM_GY modulo PARAM_P.

12 13

14

5.2.3 A-key Computation The base station shall compute the common key K = MS_RESULTY modulo PARAM_P. The base station shall use the least significant 64 bits of the result K as the A-keyA_KEY. 5.3 Mobile Station Requirements for A_KEY_P_REV = 00000011 or 00000100 5.3.1 Random Number Generation for Diffie-Hellman Key Exchange Procedure The mobile station shall set PARAM_Ps for use in calculating the mobile station result, MS_RESULT, to the following 1024-bit prime number (Most Significant Bit first): 0xFFFFFFFF 0xFFFFFFFF 0xC90FDAA2 0x2168C234 0xC4C6628B 0x80DC1CD1 0x29024E08 0x8A67CC74 0x020BBEA6 0x3B139B22 0x514A0879 0x8E3404DD 0xEF9519B3 0xCD3A431B 0x302B0A6D 0xF25F1437 0x4FE1356D 0x6D51C245 0xE485B576 0x625E7EC6 0xF44C42E9 0xA637ED6B 0x0BFF5CB6 0xF406B7ED 0xEE386BFB 0x5A899FA5 0xAE9F2411 0x7C4B1FE6 0x49286651 0xECE65381 0xFFFFFFFF 0xFFFFFFFF The mobile station shall set PARAM_Gs for use in calculating MS_RESULT to 00000010. The mobile station shall generate a random number X for use in calculating MS_RESULT. The number X shall have the following properties: The number generated shall be 256-bits in length. The number generated shall not be less than 4. The number generated shall have an uniform statistical distribution over its range. The numbers used in formulating different Key Generation Response Messages sent

15 16

17

18 19 20 21 22 23 24 25 26 27

28 29 30 31 32 33

5-86

3GPP2 C.S0016-D v2.0 by the same mobile station shall be statistically uncorrelated. The number used in formulating each Key Generation Response Message shall not be derivable from the previously used numbers or mobile station indicator values. The numbers used in formulating Key Generation Response Messages sent by different mobile stations shall be statistically uncorrelated.

1 2 3 4 5 6

5.3.2 Mobile Station Result The mobile station shall calculate MS_RESULT = PARAM_GsX modulo PARAM_Ps.

10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

5.3.3 A Key A-key and Root Key Computation for A_KEY_P_REV = 00000011 The mobile station shall compute one of the input to f0, Random Secret Seed, RAND_SEED_TEMP = BS_RESULTsX modulo PARAM_Ps. The mobile station shall store the least significant 128 bits of the result RAND_SEED_TEMP as RAND_SEED. The A-keyA_KEY and 3G Root Key RK are generated by invoking the algorithmic function f0 as specified in Section 2.2.2.2 of [8]. Since each invocation of f0 produces 64 bits, three invocation of f0 is need for a total of 192 bits. The input parameters to the algorithmic function f0 shall be set as follows: The K parameter shall be set to RAND_SEED. The fi parameter shall be set to 0x41. The Fmk parameter shall be set to 0x41484147. The mobile station shall invoke f0. The mobile station shall store the most significant bits of the result of invocation of f0 as the A_KEY_TEMPs. The mobile station shall store the remaining 128 bits of the invocation of f0 as RK_TEMPs.

25

26

5.3.4 Root Key Computation for A_KEY_P_REV = 00000100 The mobile station shall compute the Root Key RK = BS_RESULTsX modulo PARAM_Ps. The mobile station shall store the least significant 128 bits of the result RK as RK_TEMPs. 5.4 Base Station Requirements for A_KEY_P_REV = 00000011 or 00000100 5.4.1 Generation of the Key Exchange Parameters Root Key The base station shall set PARAM_Ps for use in calculating the base station result, BS_RESULT, to the following 1024-bit prime number (Most Significant Bit first): 0xFFFFFFFF 0xFFFFFFFF 0xC90FDAA2 0x2168C234 0xC4C6628B 0x80DC1CD1

27 28

29

30 31 32 33

5-87

3GPP2 C.S0016-D v2.0 0x29024E08 0x8A67CC74 0x020BBEA6 0x3B139B22 0x514A0879 0x8E3404DD 0xEF9519B3 0xCD3A431B 0x302B0A6D 0xF25F1437 0x4FE1356D 0x6D51C245 0xE485B576 0x625E7EC6 0xF44C42E9 0xA637ED6B 0x0BFF5CB6 0xF406B7ED 0xEE386BFB 0x5A899FA5 0xAE9F2411 0x7C4B1FE6 0x49286651 0xECE65381 0xFFFFFFFF 0xFFFFFFFF The base station shall set PARAM_Gs for use in calculating BS_RESULT to 00000010. The base station shall generate a random number Y for use in calculating BS_RESULT. The number Y shall have the following properties: The number generated shall be 256-bits in length. The number generated shall not be less than 4. The number generated shall have an uniform statistical distribution over its range. The numbers used in formulating different Key Generation Request Messages sent by the same base station shall be statistically uncorrelated. The numbers used in formulating Key Generation Request Message sent by different base stations shall be statistically uncorrelated.

1 2 3 4 5 6

7 8 9 10 11 12 13 14 15 16

17

5.4.2 Base Station Result The base station shall calculate BS_RESULT = PARAM_GY modulo PARAM_P.

18 19

20 21 22 23 24 25 26 27 28 29 30 31 32 33

5.4.3 A KeyA-key and Root Key Computation for A_KEY_P_REV = 00000011 The base station shall compute the input to f0, Random Secret Seed, RAND_SEED_TEMP = MS_RESULTY modulo PARAM_P. The base station shall store the least significant 128 bits of the result RAND_SEED_TEMP as RAND_SEED. The A-keyA_KEY and 3G Root Key RK are generated by invoking the algorithmic function f0 as specified in Section 2.2.2.2 of [8]. Since each invocation of f0 produces 64 bits, three invocation of f0 is need for a total of 192 bits. The input parameters to the algorithmic function f0 shall be set as follows: The K parameter shall be set to RAND_SEED. The fi parameter shall be set to 0x41. The Fmk parameter shall be set to 0x41484147. The base station shall invoke f0. The base station shall store the most significant bits of the result of invocation of f0 as the A-keyA_KEY.

5-88

3GPP2 C.S0016-D v2.0 The base station shall store the remaining 128 bits of the invocation of f0 as the Root Key K. 5.4.4 Root Key K Computation for A_KEY_P_REV = 00000100 The base station shall compute the Root Key RK = MS_RESULTY modulo PARAM_P. The base station shall use the least significant 128 bits of the result RK as the Root Key K.

1 2

4 5 6

5.5 Mobile Station Requirements for A_KEY_P_REV = 00000101 5.5.1 Random Number Generation and Key Generation Parameters The mobile station shall set PARAM_Ps for use in calculating the mobile station result, MS_RESULT, to the 1024-bit prime number as specified in 5.3.1. The mobile station shall set PARAM_Gs for use in calculating MS_RESULT to 00001101. The mobile station shall generate a random number X for use in calculating MS_RESULT. The number X shall have the following properties: The number generated shall be 384-bits in length. The number generated shall not be less than 4. The number generated shall have an uniform statistical distribution over its range. The numbers used in formulating different Key Generation Response Messages sent by the same mobile station shall be statistically uncorrelated. The number used in formulating each Key Generation Response Message shall not be derivable from the previously used numbers or mobile station indicator values. The numbers used in formulating Key Generation Response Messages sent by different mobile stations shall be statistically uncorrelated.

8 9 10 11

12 13 14 15 16 17 18 19 20 21 22 23

24 25

5.5.2 Mobile Station Result The mobile station shall calculate MS_PW_HASH as the follows: MS_PW_HASH = SHA-114 (0x00000001,0x00000001, MS_PW) modulo 2128 | SHA-1 (0x00000001,0x00000002, MS_PW) modulo 2128 | SHA-1 (0x00000001,0x00000003, MS_PW) modulo 2128 | SHA-1 (0x00000001,0x00000004, MS_PW) modulo 2128 | SHA-1 (0x00000001,0x00000005, MS_PW) modulo 2128 |

26

27

28

29

30

14 SHA-1 refers to the FIPS-180 hash function as specified in [9].

5-89

3GPP2 C.S0016-D v2.0 SHA-1 (0x00000001,0x00000006, MS_PW) modulo 2128 | SHA-1 (0x00000001,0x00000007, MS_PW) modulo 2128 | SHA-1 (0x00000001,0x00000008, MS_PW) modulo 2128 | SHA-1 (0x00000001,0x00000009, MS_PW) modulo 2128. The mobile station shall calculate MS_RESULT = (MS_PW_HASH15 * PARAM_GsX) modulo PARAM_Ps.

5 6

8 9 10 11

5.5.3 Root Key Computation for A_KEY_P_REV = 00000101 The mobile station shall compute the Root Key RK = SHA-1 (0x00000003 | 0x00000C8016 |MS_PARAM |MS_PARAM), where MS_PARAM =MS_PW| PARAM_GsX modulo PARAM_Ps| (BS_RESULTs/BS_PW_HASH) modulo PARAM_Ps| ((BS_RESULTs/BS_PW_HASH)X) modulo PARAM_PsP. The mobile station shall store the least significant 128 bits of the result RK as RK_TEMPs.

12 13 14 15

16

17

5.6 Base Station Requirements for A_KEY_P_REV = 00000101 5.6.1 Random Number Generation and Key Generation Parameters The base station shall set PARAM_Ps for use in calculating the base station result, BS_RESULT, to the following 1024-bit prime number (Most Significant Bit first) as specified in 5.4.1. The base station shall set PARAM_Gs for use in calculating BS_RESULT to 00001101. The base station shall generate a random number Y for use in calculating BS_RESULT. The number Y shall have the following properties: The number generated shall be 384-bits in length. The number generated shall not be less than 4. The number generated shall have an uniform statistical distribution over its range. The numbers used in formulating different Key Generation Request Messages sent by

18 19 20 21 22

23 24 25 26 27 28

15 MS_PW_HASH

may

be

reduced

modulo

PARAM_PS

prior

to

multiplication

to

simplify

implementation.
16 This value is set to the length of MS_PARAM in bits.

5-90

3GPP2 C.S0016-D v2.0 the same base station shall be statistically uncorrelated. The numbers used in formulating Key Generation Request Message sent by different base stations shall be statistically uncorrelated.

1 2 3 4

5 6

5.6.2 Base Station Result The base station shall calculate BS_PW_HASH where BS_PW_HASH = SHA-1 (0x00000002,0x00000001, BS_PW) modulo 2128 | SHA-1 (0x00000002,0x00000002, BS_PW) modulo 2128 | SHA-1 (0x00000002,0x00000003, BS_PW) modulo 2128 | SHA-1 (0x00000002,0x00000004, BS_PW) modulo 2128 | SHA-1 (0x00000002,0x00000005, BS_PW) modulo 2128 | SHA-1 (0x00000002,0x00000006, BS_PW) modulo 2128 | SHA-1 (0x00000002,0x00000007, BS_PW) modulo 2128 | SHA-1 (0x00000002,0x00000008, BS_PW) modulo 2128 | SHA-1 (0x00000002,0x00000009, BS_PW) modulo 2128.

10

11

12

13

14

15

16

17 18 19

The base station shall calculate BS_RESULT = (BS_PW_HASH 17 * PARAM_GY) modulo PARAM_P.

20 21 22 23 24

5.6.3 3G Root Key K Computation The base station shall compute the Root Key RK = SHA-1 (0x00000003 | 0x00000C8018 | BS_PARAM | BS_PARAM), where BS_PARAM =BS_PW| (MS_RESULT/MS_PW_HASH) modulo PARAM_P | PARAM_GY modulo PARAM_P | ((MS_RESULT/MS_PW_HASH)Y) modulo PARAM_P. The base station shall use the least significant 128 bits of the result RK as the Root Key K.

25

26 27 28

17 BS_PW_HASH may be reduced modulo P prior to multiplication to simplify implementation. 18 This value is set to the length of BS_PARAM in bits.

5-91

3GPP2 C.S0016-D v2.0 5.7 Mobile Station Requirements for A_KEY_P_REV = 00000111 5.7.1 Random Number Generation for Diffie-Hellman Key Exchange Procedure The mobile station shall set PARAM_Ps for use in calculating the mobile station result, MS_RESULT, to the 1024-bit prime number (Most Significant Bit first) specified in 5.3.1. The mobile station shall set PARAM_Gs for use in calculating MS_RESULT to 00000010. The mobile station shall generate a random number X for use in calculating MS_RESULT. The number X shall have the properties listed in 5.5.1.

2 3 4 5

6 7 8

5.7.2 Mobile Station Result The mobile station shall calculate MS_RESULT = PARAM_GsX modulo PARAM_Ps.

10

11

12

5.7.3 eHRPD Root Key Computation for A_KEY_P_REV = 00000111 The mobile station shall compute the eHRPD Root Key eRK = BS_RESULTsX modulo PARAM_Ps. The mobile station shall store the least significant 128 bits of the result eRK as eHRPD_K_TEMPs.

13 14 15

16

17

5.8 Base Station Requirements for A_KEY_P_REV = 00000111 5.8.1 Generation of the Key Exchange Parameters Root Key The base station shall set PARAM_Ps for use in calculating the base station result, BS_RESULT, to the 1024-bit prime number (Most Significant Bit first) specified in 5.4.1. The base station shall set PARAM_Gs for use in calculating BS_RESULT to 00000010. The base station shall generate a random number Y for use in calculating BS_RESULT. The number Y shall have the properties listed in 5.6.1. 5.8.2 Base Station Result The base station shall calculate BS_RESULT = PARAM_GY modulo PARAM_Ps. 5.8.3 eHRPD Root Key eHRPD_K Computation for A_KEY_P_REV = 00000111 The base station shall compute the eHRPD Root Key eRK = MS_RESULTY modulo PARAM_Ps. The base station shall use the least significant 128 bits of the result eRK as the eHRPD Root Key eHRPD_K.

18 19 20 21

22 23

24

25

26

27 28 29

5-92

3GPP2 C.S0016-D v2.0

5.9 Mobile Station Requirements for A_KEY_P_REV = 00001000 5.9.1 Random Number Generation and Key Generation Parameters The mobile station shall set PARAM_Ps for use in calculating the mobile station result, MS_RESULT, to the 1024-bit prime number as specified in 5.3.1. The mobile station shall set PARAM_Gs for use in calculating MS_RESULT to 00001101. The mobile station shall generate a random number X for use in calculating MS_RESULT. The number X shall have the properties listed in 5.5.1.

3 4 5 6

7 8 9

10 11

5.9.2 Mobile Station Result The mobile station shall calculate MS_PW_HASH as the follows: MS_PW_HASH = SHA-25619 (0x00000001,0x00000001, MS_PW) modulo 2256 | SHA-256 (0x00000001,0x00000002, MS_PW) modulo 2256 | SHA-256 (0x00000001,0x00000003, MS_PW) modulo 2256 | SHA-256 (0x00000001,0x00000004, MS_PW) modulo 2256 | SHA-256 (0x00000001,0x00000005, MS_PW) modulo 2128. The mobile station shall calculate MS_RESULT = (MS_PW_HASH20 * PARAM_GsX) modulo PARAM_Ps.

12

13

14

15

16

17 18

19

20 21 22 23

5.9.3 eHRPD Root Key Computation for A_KEY_P_REV = 00001000 The mobile station shall compute the eHRPD Root Key eRK = SHA-256 (0x00000003 | 0x00000C8021 |MS_PARAM |MS_PARAM), where MS_PARAM =MS_PW| PARAM_GsX modulo PARAM_Ps | (BS_RESULTs/BS_PW_HASH) modulo PARAM_Ps | ((BS_RESULTs/BS_PW_HASH)X) modulo PARAM_Ps.

24 25 26

19 SHA-256 refers to the FIPS-180-2 hash function as specified in [cc]. 20 MS_PW_HASH

may

be

reduced

modulo

PARAM_PS

prior

to

multiplication

to

simplify

implementation.
21 This value is set to the length of MS_PARAM in bits.

5-93

3GPP2 C.S0016-D v2.0 The mobile station shall store the least significant 128 bits of the result eRK as eHRPD_K_TEMPs.

1 2

5.10 Base Station Requirements for A_KEY_P_REV = 00001000 5.10.1 Random Number Generation and Key Generation Parameters The base station shall set PARAM_Ps for use in calculating the base station result, BS_RESULT, to the 1024-bit prime number (Most Significant Bit first) specified in 5.4.1. The base station shall set PARAM_Gs for use in calculating BS_RESULT to 00001101. The base station shall generate a random number Y for use in calculating BS_RESULT. The number Y shall have the properties listed in 5.6.1.

5 6 7 8

9 10 11

12 13

5.10.2 Base Station Result The base station shall calculate BS_PW_HASH where BS_PW_HASH = SHA-256 (0x00000002,0x00000001, BS_PW) modulo 2256 | SHA-256 (0x00000002,0x00000002, BS_PW) modulo 2256 | SHA-256 (0x00000002,0x00000003, BS_PW) modulo 2256 | SHA-256 (0x00000002,0x00000004, BS_PW) modulo 2256 | SHA-256 (0x00000002,0x00000005, BS_PW) modulo 2128.

14

15

16

17

18

19

20 21

The base station shall calculate BS_RESULT = (BS_PW_HASH 22 * PARAM_GY) modulo PARAM_Ps.

22

23 24 25 26 27

5.10.3 eHRPD Root Key eHRPD_K Computation The base station shall compute the eHRPD Root Key eRK = SHA-256 (0x00000003 | 0x00000C8023 | BS_PARAM | BS_PARAM), where BS_PARAM =BS_PW| (MS_RESULT/MS_PW_HASH) modulo PARAM_Ps | PARAM_GY modulo PARAM_Ps |

28

22 BS_PW_HASH

may

be

reduced

modulo

PARAM_Ps

prior

to

multiplication

to

simplify

implementation.
23 This value is set to the length of BS_PARAM in bits.

5-94

3GPP2 C.S0016-D v2.0 ((MS_RESULT/MS_PW_HASH)Y) modulo PARAM_Ps. The base station shall use the least significant 128 bits of the result eRK as the eHRPD Root Key eHRPD_K.

2 3 4 5

5-95

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10

This page left intentionally blank.No text

5-96

3GPP2 C.S0016-D v2.0

1 2

ANNEX A VOIDRESERVED

A-1

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10

This page left intentionally blank.No text.

A-2

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7

ANNEX B VOID(INFORMATIVE) BIBLIOGRAPHY

The documents listed in this annex are for information only and are not essential for the completion of the requirements of this standard. 1. TIA/EIA/IS-91, Mobile Station - Base Station Compatibility Standard for 800 MHz Analog Cellular, October 1994.

B-1

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10

This page left intentionally blank.

B-2

3GPP2 C.S0016-D v2.0

ANNEX C (INFORMATIVE) SYSTEM SELECTION AND ACQUISITION

2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

C.1 Introduction This is an informative annex that describes recommended use of the preferred roaming list. The preferred roaming list indicates which systems the mobile station should use (preferred systems). It also indicates which systems should not be used by the mobile station (negative systems). In addition to indicating which systems are preferred or negative, the preferred roaming list has information that can reduce the acquisition time, however, for optimum performance of the SSPR feature appropriate structuring of the roaming list is required. The preferred roaming list consists of two tables: the system table and the acquisition table. The system table contains records. Each record identifies a system by its SID and NID. For each record, there is an indicator of whether the system is preferred or negative, the roaming status that should be indicated by the mobile station, the relative priority of the system and its geographic region. Each record also contains an acquisition index that indicates a record in the acquisition table to be used. The acquisition record provides the band and frequencies that the mobile station is to use when attempting to acquire the system. Table C.1-1 illustrates the basic structure of the preferred roaming list. Table C.1-1 Preferred Roaming List PREF_ONLY No DEF_ROAM_IND On (steady) NUM_ACQ_RECS 5 NUM_SYS_RECS 12

20 21 22 23 24

Table C.1-2 illustrates the acquisition table. The records in the acquisition table are in order of priority (highest priority first) according to desired mobile station system selection scan order. Table C.1-2 Acquisition Table ACQ_INDEX 0 1 2 3 ACQ_TYPE 0110 0101 0011 0010 Description PCS CDMA - Using Channels PCS CDMA - Using Blocks Cellular CDMA - Custom Channels Cellular CDMA - Standard Channels Cellular Analog Acquisition Parameters PCS Channels 100, 125, 150, 175, 200 PCS Block C Channel Number 1 System A, Primary and Secondary CDMA Channel System B

4
25

0001

C-1

3GPP2 C.S0016-D v2.0

1 2 3

Table C.1-3 illustrates the system table. In this table, region changes are denoted by a change in shading. Table C.1-3 System Table SID 111 NID_INCL 0 PREF_NEG 1 GEO 0 PRI 1 ACQ_INDEX (ACQ_TYPE) 2 [Cellular CDMA Standard Channels] 0 [PCS CDMA Using Channels] 2 [Cellular CDMA Standard Channels] 4 [Cellular Analog] 2 [Cellular CDMA Standard Channels] 0 [PCS CDMA Using Channels] 3 [Cellular CDMA Custom Channels] 4 (Cellular Analog) 4 [Cellular Analog] 2 [Cellular CDMA Standard Channels] 1 [PCS CDMA Using Blocks] 4 [Cellular Analog] ROAM_IND Off

77 34

0 0

1 1

1 1

0 0

Off Flashing

34 400

0 0

0 1

1 0

N/A 1

N/A Off

4 12 0 776 61

0 0 0 0 0

1 1 1 0 1

1 1 1 1 0

1 1 0 N/A 1

On On On N/A Off

56 16
4

0 0

1 0

1 1

0 N/A

Flashing N/A

C.2 Accelerated System Selection C.2.1 Using Positive and Negative Systems An entry in SYS_TABLE having a PREF_NEG bit set to 1 is a preferred system. An entry in SYS_TABLE having a PREF_NEG bit set to 0 is a negative system. Once the SID of the preferred system is determined it can be used to index into the Geographic Region of the SYS_TABLE and select a system in the same Geographic Region that is preferable. The mobile station can then use the acquisition table entry to C-2

6 7 8 9 10 11

3GPP2 C.S0016-D v2.0 determine the frequencies that should be used when attempting to acquire the preferred system. Similarly, once the SID of a negative system is determined, it can be used to index into the Geographic Region of the SYS_TABLE and select a system in the same Geographic Region that is preferable. The mobile station can then use the acquisition table entry to determine the frequencies that should be used when attempting to acquire the preferred system. For example, if the mobile station acquires the analog cellular system with SID equal to 34, the mobile station should attempt to acquire the cellular CDMA system with SID equal to 111 (see Table C.1-3). If the mobile station fails to acquire this system, the mobile station should attempt to acquire the PCS CDMA system with SID equal to 77. The relative priority of two preferred systems in the same Geographic Region cannot be expressed when there are one or more negative systems listed between these preferred systems in the SYS_TABLE. For this reason, it is recommended to list negative systems after all preferred systems in their respective Geographic Regions. C.2.2 PCS Block Mode System Selection There are two acquisition types that can be used when acquiring a PCS CDMA system: PCS CDMA System Acquisition (Using Blocks) and PCS CDMA System Acquisition (Using Channels). These correspond to ACQ_TYPE equal to 0101 and ACQ_TYPE equal to 0110, respectively. When using the block mode, the mobile station may need to search all of the preferred frequency assignments (see 6.1.1.1 of [1] or [23]) within the frequency block to determine whether it can acquire the system. For the A, B and C blocks, there are 11 preferred frequency assignments. Since the acquisition time may be proportional to the number of preferred frequency assignments, specifying the entire frequency block should be avoided when a smaller set of frequencies is sufficient, thus, it is usually preferable to use the PCS CDMA System Acquisition (Using Channels) acquisition type.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

16 17 18 19 20 21 22 23 24 25 26 27 28

29 30 31 32 33 34 35 36 37 38 39 40 41

C.2.3 Special Cases and Considerations It is possible for the mobile station to acquire a channel, decode the SID/NID and find a matching SID/NID system record where the acquired channel and the acquisition type of the matching record are different. In these cases, service is allowed. For example, if the mobile station is presently scanning one of PCS channels corresponding to ACQ_TYPE = 0110 (first entry in the Table C.1-2), discovers the system with SID 61, and finds it in the system table (see Table C.1-3), service is allowed, even though the acquisition index for the record (ACQ_INDEX = 2) does not match acquired system. This situation can occur based upon service providers changing or adding channels in a market, changing broadcast SID, or purchasing another service providers market. Wildcard SIDs (SID = 0) can be used to universally allow or deny service in a particular band or mode(s) of operation. In this example, assume that cellular analog system SID 504 and cellular CDMA system SID 4101 can be acquired by the mobile station and are not

C-3

3GPP2 C.S0016-D v2.0 specifically included in the system table. Assume further that the PREF_ONLY for the preferred roaming list is set to 1 (True). The mobile station scans channels according to all acquisition table entries attempting to acquire a system with SID that matches records in the system table. After finding no matching SIDs, the mobile station allows service on the system with SID 504 acquired at the cellular analog System B. The mobile station does not allow service on system with SID 4101, since that system does not match the acquisition record associated with the system record containing the wildcard SID. C.3 Preferred Roaming List Maintenance All or any part of the preferred roaming list can be replaced using Over-the-Air Service Provisioning. Segmentation of the preferred roaming list provides access to any specific area requiring modification. An area is identified by the position offset of the first modified octet in the list and includes the number of new octets to be transmitted in one or more segments (see 3.3.1). The end of transmission is denoted by the LAST_SEGMENT field set to 1. When the end of transmission is detected, the length and CRC of the preferred roaming list must be verified to ensure the data integrity. For manageability, when replacing areas of differing sizes, it is recommended that the remaining data of the list be retransmitted and replaced as well. When the preferred roaming list data is modified, the service provider may assign a new PR_LIST_ID to the list.

1 2 3 4 5 6 7

8 9 10 11 12 13 14 15 16 17 18 19 20

C-4

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

ANNEX D (INFORMATIVE) SYSTEM SELECTION AND THE PREFERRED USER ZONE

LIST The Preferred User Zone List provides the mobile station that supports the optional User Zone feature with the specification of the User Zones to which the mobile station is subscribed. The PUZL is used after the mobile station has completed system acquisition using the preferred roaming list or other techniques. If PRL has a higher priority than PUZL (PUZL_PRL_RELATIVE_PRIORITY=0), then, once a mobile station has found its preferred system via the PRL, the PUZL is used to select the most preferred User Zone on that system. Otherwise, PUZL is first used to select a system. The PUZL contains a list of all User Zones that are subscribed to and any parameters needed to locate and access these User Zones. In the case where the network is broadcasting a Private Neighbor List Message indicating the presence of the preferred User Zone on a separate RF carrier or possibly the same RF carrier, the mobile station will then switch to that RF carrier to obtain the services of the User Zone. For the purposes of the PRL, the private system in this case can be considered to be part of the original system on which the Private Neighbor List Message was detected. The UZ_RF_INFO describes information which may be used by a Mobile Station to determine when to scan for an access point. GEO_TYPE_SPECIFIC_FIELDS describe geospatial information which may be used by a Mobile Station to determine where to scan for an AP It is noted that: Each entry in the PUZL is uniquely identified by User Zone ID and User Zone SID. Each User Zone entry within the PUZL is stored contiguously in the mobile station memory. The PUZL may be stored in a non-contiguous fashion in the mobile station memory. The PUZL may have up to 4095 User Zone entries.

D-1

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10

This page left intentionally blank.

D-2

3GPP2 C.S0016-D v2.0

ANNEX E (INFORMATIVE) MULTIMODE SYSTEM SELECTION

2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

E.1 Introduction This is an informative annex that describes the recommended use of the MMSS Location Associated Priority List (MLPL) and the MMSS System Priority List (MSPL) for Multimode System Selection (MMSS). The MLPL and the MSPL are used together for the purposes of selecting a supported cellular system based on the two priority lists. The MLPL is a list of records based on location specific information. The MLPL allows the operators to specify the MMSS System Priority List to be used for a particular location record. Typically, the MLPL consists of many location records. For each location record (or, equivalently, MLPL record), one to three location parameter values (i.e., Mobile Country Code (MCC), Mobile Network Code (MNC) and SYS_LOC_TAG) may be specified along with a MSPL_INDEX which specifies the associated MSPL. The MSPL is a list of records for prioritizing cdma2000 and non-cdma2000 cellular systems. The MSPL assists a multimode mobile station in selecting a system. Once a system is selected, the mobile station follows the network selection procedures according to the requirements of that system. After acquiring a system, the multimode mobile station searches for systems having a higher priority in the MSPL after a time that may be specified by HIGHER_PRI_SRCH_TIMER. There can be only one MSPL record associated with a location grouping specified in an MLPL record; however, any number of MLPL records may have the same MSPL_INDEX. The next two sections describe the MLPL and MSPL in more detail. E.1.1 MMSS Location Associated Priority List (MLPL) An MLPL record may consist of one to three location parameter values: MCC, MNC and SYS_LOC_TAG. SYS_LOC_TAG is a location TAG associated with specific networks within a system. Typically, an operator will define an MLPL record for each country where there is a roaming agreement. If the priority for system selection is to be the same within any given country, then only the MCC parameter can be used to define the location parameter value. For example, if the home operator has roaming agreements with 5 countries, the MLPL may consist of the following 5 records: Table E.1.1-1 MLPL MLPL record 1 2 3 4 5 MCC 1 2 3 4 5 MNC SYS_LOC_TAG MSPL_INDEX MSPL 1 MSPL 2 MSPL 3 MSPL 4 MSPL 4

22 23 24 25 26 27 28 29 30

E-1

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Note that MNC and SYS_LOC_TAG are not needed since each country has only one system selection priority list indicated by MSPL_INDEX. Note the 4th and the 5th records are both associated with the same MSPL_INDEX (i.e., the two countries have the same order of priorities for system selection). The MNC and SYS_LOC_TAG location parameter values are only used when multiple MSPL records are needed within a country. An MNC is unique in a given country and is issued to a specific operator. If the roaming agreements differ from one region of the country to another (e.g., due to availability of services) it may be necessary for the home operator to create two MLPL records pointing to two MSPL records. For example, the home operator may have roaming agreements with operator A (GSM with MNC = 1) and operator B (cdma2000 1x), but less favorable roaming agreements with operator C (GSM with MNC =2) and operator D (cdma2000 1x). It is further assumed that operators A and D serve one region (region 1) of the country whereas operators B and C serve another region of the same country (region 2). For region 1, the preference is for mobile stations to roam onto operator As GSM system followed by operator Ds cdma2000 1x system. For region 2, the preference is for operator Bs cdma2000 1x system followed by operator Cs GSM system.

Region 1
Operator A (GSM) > Operator D (cdma2000 1x)

Region 2
Operator B (cdma2000 1x) > Operator C (GSM)

Using one MSPL to set priorities between cdma2000_AI and 3GPP_AI is clearly insufficient due to the difference in operators requirement for system selection. The two MLPL records may be constructed as follows: Table E.1.1-2 MLPL using MNC MLPL Record 1 2 MCC 1 1 MNC 1 2 SYS_LOC_TAG MSPL_INDEX MSPL 1 MSPL 2

29 30 31 32 33

Note that the first MLPL record is associated with MNC = 1 (operator A) and points to MSPL 1 (with 3GPP_AI preferred over cdma2000_AI). The second MLPL record is associated with MNC = 2 (operator C) and points to MSPL 2 (with cdma2000_AI preferred over 3GPP_AI). Mobile stations operating in region 1 would use the first MLPL record while mobile stations operating in region 2 would use the second MLPL record.

E-2

3GPP2 C.S0016-D v2.0 In some cases it may be desirable for the operator to add SYS_LOC_TAG information to the MLPL records. The SYS_LOC_TAG information for the cdma2000 network is defined by the SID/NID info associated with particular cdma2000 networks. However, in general, there can be more than one SYS_LOC_TAG information belonging to different systems (i.e., SYS_LOC_TAG could be associated with 3GPP_AI and WiMAX) in the same MLPL record. Using the same example as above for Operators A, B, C and D, it is further assumed that Operator Bs cdma2000 1x system uses SID = 5 and NID = 40 while Operator Ds cdma2000 1x system uses SID = 2 and NID = 25. Table E.1.1-3 MLPL with SYS_LOC TAG MLPL recor d 1 2 3 4 MCC MNC SYS_TYPE 1 SYS_LOC _TAG 1 1 1 1 1 1 2 0 (cdma2000_AI) 0 (cdma2000_AI) 2 (SID) 5 (SID) 25 (NID_START) 40 (NID_START) 0 (NID_RANGE) 0 (NID_RANGE) SYS_LOC _TAG 2 SYS_LOC _TAG 3 MSPL _IND EX 1 2 1 2

1 2 3 4 5 6 7 8 9

10

SYS_LOC_TAG
11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

With the SYS_LOC_TAG information, if the mobile station were to discover the GSM network with MNC = 1 the first MLPL should be used. If the mobile station were to discover the GSM network with MNC = 2 the second MLPL should be used. If the mobile were to discover the cdma2000 1x network with SID = 2, NID = 25 the third MLPL record should be used. Lastly, if the mobile station were to discover the cdma2000 1x network with SID = 5, NID = 40, the fourth MLPL record should be used. Typically, not all location parameter values are applicable to every system. In this example, the GSM system uses only the MCC and MNC location parameter values while the cdma2000 systems use only the MCC and the SYS_LOC_TAG location parameter values. Since the 1st and 3rd MLPL records in Table E.1.1-3 have the same MCC value and they both map to the same MSPL_INDEX, the two MLPL records can be combined into one MLPL record to reduce storage space (refer to Table E.1.1-4). Similarly, the 2nd and 4th MLPL records can be combined to form one MLPL record. In this case the first MLPL record is used if the mobile station discovers either MNC = 1 while operating on the GSM system or SID=2/NID=25 while operating on the cdma2000 system. The second MLPL record is used if the mobile station discovers either MNC = 2 while operating on the GSM system or SID=5/NID=40 while operating on the cdma2000 system. In some cases, the mobile station may have more than one MLPL record to choose from based on the location parameter values. In these cases, the MLPL record with the finest

E-3

3GPP2 C.S0016-D v2.0 granularity is chosen first (i.e., MLPL record containing SYS_LOC_TAG information), followed by the MLPL record with lesser granularity (i.e., MLPL record containing MNC information). Finally, the MLPL record with the least level of granularity is chosen last (i.e., MLPL record containing MCC only). As an example, if the mobile station acquired a cdma2000 network with SID = 5, NID = 40 in MCC 1, it uses the third MLPL record in Table E.1.1-5 since the third MLPL record has better granularity. On the other hand, if the mobile station acquired a network in MCC 1 but the network parameters do not match any of the MNC or SYS_LOC_TAG in the MLPL, then the MLPL record with only the MCC value is used. Table E.1.1-5 MLPL with different levels of granularity MLPL recor d 1 2 3 MCC MNC SYS_TYPE 1 SYS_L OC _TAG 1 1 1 1 1 2 0 (cdma2000_AI) 5 (SID) 40 (NID_START) 0 (NID_RANGE) SYS_LOC _TAG 2 SYS_LOC _TAG 3 MSPL _INDE X 1 2 3

1 2 3 4 5 6 7 8 9 10

11

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

E.1.2 MMSS System Priority List (MSPL) In addition to the system selection based on system types (i.e., SYS_TYPE), the MSPL has a number of additional parameters to assist the multimode mobile station in deciding which system to select. These additional parameters include PRI_CLASS, SYS_PRI and HIGHER_PRI_SRCH_TIME. All three fields are applicable to any of the system types listed in Table 3.5.13.4-1. In particular, the PRI_CLASS may be used to define system priority based on different classes of networks within a system. The HIGHER_PRI_SRCH_TIME parameter can define the time between searches of higher priority systems of other radio access technologies. The PRI_CLASS parameter can take on one of three values (0000 =HOME, 0001=HOME + PREFERRED and 1111=ANY), see section 3.5.13.4. Since each system has its own method and format for creating a priority list or roaming list, the mapping of the PRI_CLASS to networks in the priority list or roaming list may appear different from one system to another. A description of the HOME priority class is given below:

If the SYS_TYPE = cdma2000_AI, the HOME priority class is the set of most preferred systems in each GEO. Note, if the PRL lists a series of HRPD entries at the top of a GEO, and, at least one of the HRPD system records in the series has the Priority bit set to MORE, even the most preferred 1x system in the GEO will not be part of the HOME priority class.

E-4

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43

If the SYS_TYPE = 3GPP_AI, the HOME priority class specifies the set of PLMNs present in the HPLMN and EHPLMN (with or without Access Technologies AcT). If the SYS_TYPE = cdma2000 1x, the HOME priority class specifies the set of most preferred 1x systems in each GEO. If the SYS_TYPE = cdma2000 HRPD, the HOME priority class specifies the set of most preferred cdma2000 HRPD systems in each GEO. If the SYS_TYPE = GERAN, the HOME priority class specifies the GSM PLMNs in the HPLMN or EHPLMN. Note, that if the GSM bit is not set and any other technology bit is set in the Access Technology ID (AcT) bitmap of each PLMN in all the HPLMN and EHPLMN entries, then no GSM system will be part of the HOME priority class. If the SYS_TYPE = UTRAN, the HOME priority class specifies the UMTS PLMNs in the HPLMN or EHPLMN. Note, that if the UMTS bit is not set and any other technology bit is set in the Access Technology ID (AcT) bitmap of each PLMN in all the HPLMN and EHPLMN entries, then no UMTS system will be part of the HOME priority class. If the SYS_TYPE = EUTRAN, the HOME priority class specifies the LTE PLMNs in the HPLMN or EHPLMN. Note, that if the LTE bit is not set and any other technology bit is set in the Access Technology ID (AcT) bitmap of each PLMN in all the HPLMN and EHPLMN entries, then no LTE system will be part of the HOME priority class.

A description of the HOME + PREFERRED priority class is given below:

If the SYS_TYPE = cdma2000_AI, the Home + Preferred priority class is the set of second most preferred systems plus the most preferred systems in each GEO. If the SYS_TYPE = 3GPP_AI, the Home + Preferred priority class may include the highest priority PLMN present in the OPLMN plus the PLMNs in the HPLMN and EHPLMN. Alternatively, the Home + Preferred priority class may include all of the PLMNs in the OPLMN plus the PLMNs in the HPLMN and EHPLMN. If the SYS_TYPE = cdma2000 1x, the Home + Preferred priority class includes the set of second most preferred 1x systems plus the most preferred systems in each GEO.. If the SYS_TYPE = cdma2000 HRPD, the Home + Preferred priority class includes the set of second most preferred plus the most preferred cdma2000 HRPD systems in each GEO. If the SYS_TYPE = GERAN, the Home + Preferred priority class includes the GSM PLMNs in the OPLMN plus the GSM PLMNs in the HPLMN and EHPLMN. If the SYS_TYPE = UTRAN, the Home + Preferred priority class includes the UMTS PLMNs in the OPLMN plus the UMTS PLMNs in the HPLMN and EHPLMN.

E-5

3GPP2 C.S0016-D v2.0

1 2 3 4 5 6 7 8 9 10 11 12

If the SYS_TYPE = EUTRAN, the Home + Preferred priority class includes the LTE PLMNs in the OPLMN plus the LTE PLMNs in the HPLMN and EHPLMN.

It is recommended that the ANY priority class be applied to any remaining entries not included in other priority classes.

Examples are given below for PRI_CLASS mappings for cdma2000_AI and 3GPP_AI systems. Note, these examples are informative and other interpretations and implementations are possible. For cdma2000, assume the Preferred Roaming List (PRL) for one GEO consists of the following networks. Note, this GEO is associated with a specific MLPL entry which in turn identifies an MSPL_INDEX.

Table E.1.2-1 Simplified cdma2000 PRL example for one GEO INDEX 0 1 2 3 4 5 SID 1 3 3 3 5 5 NID 1 40 2 15 20 75 NEG/PREF PREF PREF PREF PREF PREF PREF PRI MORE SAME SAME MORE SAME MORE GEO NEW SAME SAME SAME SAME SAME

13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

Based on Table E.1.2-1, the following mappings of PRI_CLASS are recommended: PRI_CLASS = HOME maps to INDEX = 0 since the first entry is the highest priority network in the GEO. PRI_CLASS = PREFERRED maps to INDEX = 0, 1, 2 and 3 since the next three entries for SID = 3 have equal priorities based on PRI. The HOME network represented by INDEX = 0 is also included in PREFERRED by definition. PRI_CLASS = ANY maps to any cdma2000 networks regardless of whether it is listed in the PRL or not. When 3GPP_AI is used, the PRI_CLASS defined in the MSPL map to entries in the PLMN selector list. The PLMN selector may contain the Home PLMN (HPLMN) or Equivalent HPLMN (EHPLMN), Operator-controlled PLMN (OPLMN) and the Forbidden PLMN. For example, assume an MLPL entry defined by MCC1 points to an MSPL_INDEX matching an entry containing PRI_CLASS entries for HOME, PREFERRED, and ANY associated with 3GPP_AI. If the EHPLMN and the OPLMN consist of the following networks in MCC1.

E-6

3GPP2 C.S0016-D v2.0

Table E.1.2-2 PLMN selector example Entry Type EHPLMN EHPLMN OPLMN OPLMN OPLMN PLMN Entry PLMN 1 PLMN 2 PLMN 3 PLMN 4 PLMN 5

3 4 5 6 7 8 9 10

PRI_CLASS = HOME, maps to PLMN 1 and PLMN 2 since PLMN 1 and PLMN 2 belong to the EHPLMN list. PRI_CLASS = PREFERRED maps to PLMNs 1, 2 and 3 since PLMN 3 belongs to the OPLMN. The HOME networks represented by PLMNs 1 and 2 are also included in PREFERRED by definition. These entries are associated with the current region. PRI_CLASS = ANY maps to any 3GPP_AI networks regardless of whether it is listed in the PLMN selector or not. In this example, PLMNs 4 and 5 map to PRI_CLASS = ANY.

11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

A description of how a mobile station should determine the timing of a search for a higher priority system based on HIGHER_PRI_SRCH_TIME is provided: After an initial system selection or a previous search for a higher priority system a mobile station should search for a higher priority system after a time specified by HIGHER_PRI_SRCH_TIME.

If the SYS_TYPE (Table 3.5.13.4-1) used in the MMSS System Priority List (MSPL) describes a family of radio access technologies, i.e. cdma2000_AI or 3GPP_AI, the mobile station should search for higher priority systems across different families of radio access technologies after the time period specified by HIGHER_PRI_SRCH_TIME. If the SYS_TYPE (Table 3.5.13.4-1) used in the MSPL is cdma2000 1x, HRPD, WiMAX, GERAN (GSM), UTRAN (UMTS), or EUTRAN (LTE), the following rules apply: 1) If the mobile station is on a lower priority 3GPP2 system, i.e. either HRPD or cdma2000 1x, the mobile station should search for higher priority 3GPP, i.e. GERAN, UTRAN and EUTRAN, and WiMAX systems after the time period specified by HIGHER_PRI_SRCH_TIME. A mobile station on a lower priority 3GPP2 system follows 3GPP2 specifications when searching for 3GPP2 radio access technologies.

E-7

3GPP2 C.S0016-D v2.0 2) If the mobile station is on a lower priority 3GPP system, i.e. GERAN, UTRAN, or EUTRAN, the mobile station should search for higher priority 3GPP2, i.e. cdma2000 1x, cdma2000 HRPD, and WiMAX systems after the time period specified by HIGHER_PRI_SRCH_TIME. A mobile station on a lower priority 3GPP system follows 3GPP specifications when searching for 3GPP radio access technologies. 3) If the mobile station is on a lower priority WiMAX system, the mobile station should search for higher priority 3GPP, i.e. GERAN, UTRAN, and EUTRAN, and 3GPP2, i.e. cdma2000 1x and cdma2000 HRPD, systems after the time period specified by HIGHER_PRI_SRCH_TIME.

1 2 3 4 5 6 7 8 9 10 11

12 13 14 15 16 17

E.1.2.1 MMSS System Priority List (MSPL) Example This section provides an example using generic SYS_TYPES for an MSPL entry that is associated by an MLPL entry that maps to MCC1. In this region, the desired priorities are defined as LTE (MNC1) > HRPD (Subnet 1) > UMTS (MNC2) > HRPD or 1x > GSM

18

The MSPL can be constructed in the following fashion: SYS_TYPE 3GPP_AI cdma2000_AI 3GPP_AI cdma2000AI 3GPP_AI PRI_CLAS S Home Home Preferred Any Any PRI More More More More More

19

20

The associated PLMN selector can be constructed as follows Entry Type EHPLMN OPLMN OPLMN PLMN Entry MCC1 MNC1 MCC1 MNC2 MCC1 MNC2 Access Technology LTE UMTS GSM

21

22

The simplified PRL can be constructed as follows E-8

3GPP2 C.S0016-D v2.0

INDEX 0 1 2
1

SID

NID

Subnet ID 1 2

NEG/PREF PREF PREF PREF

PRI MORE MORE MORE

GEO NEW SAME SAME

2 3 4 5 6 7 8 9 10 11 12 13 14

E.1.2.2 MMSS System Priority List (MSPL) with Specific System_Types This section describes examples of the MSPL with System Types using specific air-interface technologies.

Example E.1.2.2-1. For a system prioritization based on the following using air-interface technologies

LTE > HRPD > UMTS > 1x > GSM,

the MSPL can be designed as in Table E.1.2.2-1. It is important to note that this list must be designed to be consistent with the corresponding 3GPP and 3GPP2 system priorities.

Table E.1.2.2-1 MSPL Example E.1.2.2-1 SYS_TYPE 0000 0111 (LTE) 0000 0100 (HRPD) 0000 0110 (UMTS) 0000 0011 (1x) 0000 0101 (GSM) PRI_CLASS 0010 (Any) 0010 (Any) 0010 (Any) 0010 (Any) 0010 (Any) SYS_PRI 1 (More) 1 (More) 1 (More) 1 (More) 0 (End)

15 16 17 18 19 20 21 22

Example E.1.2.2-2. Consider the following multimode system priority list LTE(MCC_1 MNC 1) > HRPD(Subnet_1) > LTE(MCC1, MNC_2 to MNC_3) > HRPD(Subnet_2) > UMTS(MCC_1, MNC_2 to MNC_3) > 1x(SID_1, NID_1)

E-9

3GPP2 C.S0016-D v2.0 > GSM(MCC_1, MNC_2 to MNC_3) > cdma2000_AI (Any) > 3GPP_AI(Any).

1 2 3 4 5 6 7 8

This can be realized by designing the MSPL using Table E.1.2.2-2 based on the PRL in Table E.1.2.2-3, the PLMN Selector List in Table E.1.2.2-4 and MLPL Record 1 of the MLPL in Table E.1.2.2-5. MCC 1 is assumed to map to SID 1.

Table E.1.2.2-2 MSPL Index 1 for Example E.1.2.2-2 SYS_TYPE 0000 0111 (LTE) 0000 0100 (HRPD) 0000 0111 (LTE) 0000 0100 (HRPD) 0000 0101 (UMTS) 0000 0011 (1x) 0000 0101 (GSM) 0000 0000 (cdma2000_AI) 0000 0001 (3GPP_AI) PRI_CLASS 0000 (Home) 0000 (Home) 0001 (Home+Preferred) 0001 (Home+Preferred) 0001 (Home+Preferred) 0001 (Home) 0001 (Home+Preferred) 0010 (Any) 0010 (Any) SYS_PRI 1 (More) 1 (More) 1 (More) 1 (More) 1 (More) 1 (More) 1 (More) 1 (More) 0 (End)

10

11

Table E.1.2.2-3 Simplified cdma2000 PRL for Example E.1.2.2-2 INDEX 0 1 2 3 1 3 1 40 SID NID Subnet ID 1 2 NEG/PREF PREF PREF PREF PREF PRI MORE MORE MORE SAME GEO NEW SAME SAME SAME

12 13

Table E.1.2.2-4 Simplified PLMN Selector List for Example E.1.2.2-2 EHPLMN MCC_1, MNC_1 OPLMN MCC_1, MNC_2 MCC_1, MNC_3 E-10

3GPP2 C.S0016-D v2.0

Table E.1.2.2-5 MLPL for Example E.1.2.2-2 MLPL Recor d Index 1 2 3 MCC MNC SYS_TYPE 1 SYS_LOC _TAG 1 SYS_LOC _TAG 2 SYS_LOC _TAG 3 MSPL _INDE X 1 1 0 (cdma2000) 0 (cdma2000) 1 (SID) 3 (SID) 1 (NID_START) 40 (NID_START) 0 (NID_RANGE) 0 (NID_RANGE) 1 1

1 1

4 5 6 7 8 9 10 11 12

E.1.2.3 MMSS System Priority List (MSPL) Examples of Higher Priority Search Time This section describes examples of the use of HIGHER_PRI_SRCH_TIME in the MSPL with various values of SYS_TYPE.

Example E.1.2.3-1. For a system prioritization based on 3GPP_AI i.e. GSM/UMTS/LTE grouped as a single system type, having a higher priority than cdma2000_AI i.e. HRPD/1x grouped as a single system type, the MSPL can be grouped as shown in Table E.1.2.3-1.

Table E.1.2.3-1 MSPL Example 1 for Higher Priority Search Time SYS_TYPE 0000 0001 (3GPP_AI) 0000 0000 (cdma2000_AI) SYS_PRI 1 (More) 0 (End) HIGHER_PRI_SRCH_TIME 111 (value is ignored) 100 (4 minutes)

13 14 15 16 17 18 19 20 21 22

In this case, if the mobile station is on either an HRPD or a cdma2000 1x system i.e. cdma2000_AI, then the mobile station searches for a 3GPP_AI i.e. GSM, UMTS, or LTE, system every four minutes based on the HIGHER_PRI_SRCH_TIME value in the table. If the mobile station is on a 3GPP_AI system, it is already on the highest priority system, so the value of HIGHER_PRI_SRCH_TIME is not used.

Example E.1.2.3-2. For a system prioritization based on LTE having a higher priority than HRPD or cdma2000 1x, but with HRPD and cdma2000 1x having the same priority, the MSPL can be grouped as shown in Table E.1.2.3-2.

E-11

3GPP2 C.S0016-D v2.0 Table E.1.2.3-2 MSPL Example 2 for Higher Priority Search Time SYS_TYPE 0000 0111 (LTE) 0000 0100 (HRPD) 0000 0011 (cdma2000 1x)
2 3 4 5 6 7 8 9 10 11 12 13 14

SYS_PRI 1 (More) 0 (Same) 0 (End)

HIGHER_PRI_SRCH_TIME 111 (value is ignored) 011 (8 minutes) 100 (4 minutes)

In this case, if the mobile station is on a cdma2000 1x system, then the mobile station searches for an LTE system every four minutes based on the HIGHER_PRI_SRCH_TIME value in the table. If the mobile station is on an HRPD system, then the mobile station searches for an LTE system every eight minutes based on the HIGHER_PRI_SRCH_TIME value in the table. If the mobile station is on a LTE system, it is already on the highest priority system, so the value of HIGHER_PRI_SRCH_TIME is not used.

Example E.1.2.3-3. For a system prioritization based on the following using air-interface technologies LTE > HRPD > UMTS > 1x > GSM, the MSPL can be designed as in Table E.1.2.3-3.

Table E.1.2.3-3 MSPL Example 3 for Higher Priority Search Time SYS_TYPE 0000 0111 (LTE) 0000 0100 (HRPD) 0000 0110 (UMTS) 0000 0011 (1x) 0000 0101 (GSM) SYS_PRI 1 (More) 1 (More) 1 (More) 1 (More) 0 (End) HIGHER_PRI_SRCH_TIME 111 (value is ignored) 100 (16 minutes) 011 (8 minutes) 010 (4 minutes) 001 (2 minutes)

15 16 17 18 19 20 21 22 23 24 25 26

In this case, if the mobile station is on a cdma2000 1x system, then the mobile station searches for an LTE or UMTS system every four minutes based on the HIGHER_PRI_SRCH_TIME value in the table. If the mobile station is on an HRPD system, then the mobile station searches for an LTE system every 16 minutes based on the HIGHER_PRI_SRCH_TIME value in the table. If the mobile station is on a LTE system, it is already on the highest priority system, so the value of HIGHER_PRI_SRCH_TIME is not used. If the mobile station is on a GSM system, then the mobile station searches for a cdma2000 1x or HRPD system every two minutes. If the mobile station is on a UMTS system, then the mobile station searches for a HRPD system every eight minutes. If the mobile station is on a LTE system, it is already on the highest priority system, so the value of HIGHER_PRI_SRCH_TIME is not used. E-12